d3d9034b158c7275d8dbc8157fc39f8189e616e3656b379e2af0e33eda481d23

Resubmissions

11/07/2023, 10:18

11/07/2023, 09:39

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2023, 10:18

Target

Janes-Zoo.exe
Size

28.2MB
MD5

97d18e1473f7c7c2c57a59667f1e5b94
SHA1

733fac61c91790fa6eeae4e3b6a55ddffba5ebfa
SHA256

d3d9034b158c7275d8dbc8157fc39f8189e616e3656b379e2af0e33eda481d23
SHA512

43fe9cb93cc52568ea36428cf534bc8b8440bd10041d36aa314528aa2385dbf149877ced50b410df51fcd183f76cb466a53f5d8cd8b9b5cf224fc23ce3d85ead
SSDEEP

786432:PC0kqK9anuc63LbPDlirX7yMPau2Z+1NpnHFXtA:PC0kp9FcYbDlfMPr1XFXtA

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3816	Janes-Zoo.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 3816	1980	Janes-Zoo.exe	85
PID 1980 wrote to memory of 3816	1980	Janes-Zoo.exe	85
PID 1980 wrote to memory of 3816	1980	Janes-Zoo.exe	85

C:\Users\Admin\AppData\Local\Temp\Janes-Zoo.exe
"C:\Users\Admin\AppData\Local\Temp\Janes-Zoo.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Users\Admin\AppData\Local\Temp\is-NNMST.tmp\Janes-Zoo.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-NNMST.tmp\Janes-Zoo.tmp" /SL5="$B0054,28617408,721408,C:\Users\Admin\AppData\Local\Temp\Janes-Zoo.exe"
  2⤵
  - Executes dropped EXE
  PID:3816

C:\Users\Admin\AppData\Local\Temp\is-NNMST.tmp\Janes-Zoo.tmp

Filesize
2.4MB

MD5
5931a48cfb02b3a4dbf9c35dc8874bb6

SHA1
eab7fa8842b382fbebca4b2d83d782aa57bc5d86

SHA256
e018eae8e6f706fc12f01c42846e973cfc9160ecd346eec59c9043a9466328f9

SHA512
b5c83828ae593252a5fd2e4dc290fdc18474f354604b00ad7a096faa3a08126dba042610c856cf17aa12e528fd937509b2d0a87b896848c5651546d5287207f1

Download Submit
memory/1980-133-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/1980-140-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/3816-139-0x0000000002660000-0x0000000002661000-memory.dmp

Filesize
4KB

Download
memory/3816-141-0x0000000000400000-0x0000000000679000-memory.dmp

Filesize
2.5MB

Download