ab4b1eb70d59b59c8faefadab7c68685de522d4030f3c2914eb71842ab80fcfb

Analysis

max time kernel
160s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 11:16

Target

ab4b1eb70d59b59c8faefadab7c68685de522d4030f3c2914eb71842ab80fcfb.exe
Size

84KB
MD5

30338cd855dbcb5da2ccdee6715ddc3e
SHA1

d587f457405699b8ba442b8ac72376402a423b22
SHA256

ab4b1eb70d59b59c8faefadab7c68685de522d4030f3c2914eb71842ab80fcfb
SHA512

c63b7584e407230c5cacf585d1f11edf61c9d26c186084e06d949fc7a35082d48792f91b6d4af4f2829ff5398330e016af27672188857b8d1bc6508ad9a8e0a7
SSDEEP

1536:rImjxDgeexMOQEmNJqkn11w7hC2t4mXdRNh9gf1pQRIlWJwy:pxD+iNEBk11ww2t4mD941p6IlWOy

Score

7^/10

persistence

Executes dropped EXE 2 IoCs

pid	Process
872	mesuau.exe
4332	mesuau.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\mesuau.exe	ab4b1eb70d59b59c8faefadab7c68685de522d4030f3c2914eb71842ab80fcfb.exe
File opened for modification	C:\Windows\mesuau.exe	ab4b1eb70d59b59c8faefadab7c68685de522d4030f3c2914eb71842ab80fcfb.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1916	ab4b1eb70d59b59c8faefadab7c68685de522d4030f3c2914eb71842ab80fcfb.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 872 wrote to memory of 4332	872	mesuau.exe	84
PID 872 wrote to memory of 4332	872	mesuau.exe	84
PID 872 wrote to memory of 4332	872	mesuau.exe	84

C:\Windows\mesuau.exe
C:\Windows\mesuau.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872
- C:\Windows\mesuau.exe
  C:\Windows\mesuau.exe Win7
  2⤵
  - Executes dropped EXE
  PID:4332

C:\Windows\mesuau.exe

Filesize
84KB

MD5
30338cd855dbcb5da2ccdee6715ddc3e

SHA1
d587f457405699b8ba442b8ac72376402a423b22

SHA256
ab4b1eb70d59b59c8faefadab7c68685de522d4030f3c2914eb71842ab80fcfb

SHA512
c63b7584e407230c5cacf585d1f11edf61c9d26c186084e06d949fc7a35082d48792f91b6d4af4f2829ff5398330e016af27672188857b8d1bc6508ad9a8e0a7

Download Submit
C:\Windows\mesuau.exe

Filesize
84KB

MD5
30338cd855dbcb5da2ccdee6715ddc3e

SHA1
d587f457405699b8ba442b8ac72376402a423b22

SHA256
ab4b1eb70d59b59c8faefadab7c68685de522d4030f3c2914eb71842ab80fcfb

SHA512
c63b7584e407230c5cacf585d1f11edf61c9d26c186084e06d949fc7a35082d48792f91b6d4af4f2829ff5398330e016af27672188857b8d1bc6508ad9a8e0a7

Download Submit
C:\Windows\mesuau.exe

Filesize
84KB

MD5
30338cd855dbcb5da2ccdee6715ddc3e

SHA1
d587f457405699b8ba442b8ac72376402a423b22

SHA256
ab4b1eb70d59b59c8faefadab7c68685de522d4030f3c2914eb71842ab80fcfb

SHA512
c63b7584e407230c5cacf585d1f11edf61c9d26c186084e06d949fc7a35082d48792f91b6d4af4f2829ff5398330e016af27672188857b8d1bc6508ad9a8e0a7

Download Submit
memory/872-6-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1916-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download