4579c9495bc5a87e378ec69d6e21b77dfa76117f9a611ee78b54138e2cb7652c

Analysis

max time kernel
151s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
23/09/2023, 06:16

Target

dmaster.exe
Size

7.4MB
MD5

ba03fdb3763c4ee453bb7af4ad7ba03d
SHA1

1d9b0ffb3b95df8d7a6db02f0cf55c388aa797d9
SHA256

4579c9495bc5a87e378ec69d6e21b77dfa76117f9a611ee78b54138e2cb7652c
SHA512

bbfc19c8e82d32037a34608338de85718f1c2653b7126cf63121369e8c980d5de460f673b0a4092e476cabaef6bb9c3d4776103af4cf5e380e631a0e741c56b7
SSDEEP

196608:m155RN0ztDHSbFMuxZYxR100JoUW44FNZMM97jnR+fg:+OLxR11QbNlFR+fg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
960	dmaster.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 960	2408	dmaster.exe	86
PID 2408 wrote to memory of 960	2408	dmaster.exe	86
PID 2408 wrote to memory of 960	2408	dmaster.exe	86

C:\Users\Admin\AppData\Local\Temp\dmaster.exe
"C:\Users\Admin\AppData\Local\Temp\dmaster.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Users\Admin\AppData\Local\Temp\is-FUVGR.tmp\dmaster.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-FUVGR.tmp\dmaster.tmp" /SL5="$E0180,7346315,121344,C:\Users\Admin\AppData\Local\Temp\dmaster.exe"
  2⤵
  - Executes dropped EXE
  PID:960

C:\Users\Admin\AppData\Local\Temp\is-FUVGR.tmp\dmaster.tmp

Filesize
1.1MB

MD5
70c679ba6d36d9c2e2e53c84593b1c27

SHA1
94f28bb5c70f138702b9397463756b6c06898874

SHA256
48194401a75913646fa2258830f21e255087ed1b517d18460b1cf0dcc9c414e7

SHA512
ee248d370b85bf726bf9ac17ec3abf21b8f45b0528900c92363a7233d1146f8439c40b118b1aeee18a8a90a1a1713f20815d55ce945dea74a8e0846f1b77a4c9

Download Submit
memory/960-6-0x0000000000700000-0x0000000000701000-memory.dmp

Filesize
4KB

Download
memory/960-16-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/960-17-0x0000000000700000-0x0000000000701000-memory.dmp

Filesize
4KB

Download
memory/2408-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2408-14-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download