4579c9495bc5a87e378ec69d6e21b77dfa76117f9a611ee78b54138e2cb7652c

Analysis

max time kernel
156s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
23/09/2023, 05:49

Target
dmaster.exe
Size 7.4MB
Sample230923-gjf8hsfa84
SHA256 4579c9495bc5a87e378ec69d6e21b77dfa76117f9a611ee78b54138e2cb7652c
MD5 ba03fdb3763c4ee453bb7af4ad7ba03d
SHA1 1d9b0ffb3b95df8d7a6db02f0cf55c388aa797d9
SHA512 bbfc19c8e82d32037a34608338de85718f1c2653b7126cf63121369e8c980d5de460f673b0a4092e476cabaef6bb9c3d4776103af4cf5e380e631a0e741c56b7
SSDEEP 196608:m155RN0ztDHSbFMuxZYxR100JoUW44FNZMM97jnR+fg:+OLxR11QbNlFR+fg
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4140	dmaster.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 4140	3648	dmaster.exe	86
PID 3648 wrote to memory of 4140	3648	dmaster.exe	86
PID 3648 wrote to memory of 4140	3648	dmaster.exe	86

C:\Users\Admin\AppData\Local\Temp\dmaster.exe
"C:\Users\Admin\AppData\Local\Temp\dmaster.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Users\Admin\AppData\Local\Temp\is-HO32B.tmp\dmaster.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-HO32B.tmp\dmaster.tmp" /SL5="$B006C,7346315,121344,C:\Users\Admin\AppData\Local\Temp\dmaster.exe"
  2⤵
  - Executes dropped EXE
  PID:4140

dmaster.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-HO32B.tmp\dmaster.tmp
Size 1.1MB
SHA256 48194401a75913646fa2258830f21e255087ed1b517d18460b1cf0dcc9c414e7
MD5 70c679ba6d36d9c2e2e53c84593b1c27
SHA1 94f28bb5c70f138702b9397463756b6c06898874
SHA512 ee248d370b85bf726bf9ac17ec3abf21b8f45b0528900c92363a7233d1146f8439c40b118b1aeee18a8a90a1a1713f20815d55ce945dea74a8e0846f1b77a4c9
SSDEEP 24576:CtdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFt5lTxyt/b:qqTytRFk6ek1LUb
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3648-1-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/3648-14-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4140-6-0x0000000000720000-0x0000000000721000-memory.dmp

Download

memory/4140-16-0x0000000000400000-0x000000000052D000-memory.dmp

Download

memory/4140-17-0x0000000000720000-0x0000000000721000-memory.dmp

Download