1f56d970f18625db69c9e59463bb655a1f641157de1064be94d9effdf6ada5b5

Analysis

max time kernel
86s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 03:42

Target

086_herpa_GS.exe
Size

165KB
MD5

79bba3d779a8c556540bdd36e4cf71fe
SHA1

a91d62a15bf842fa4d99683f36c85084a6dc43ef
SHA256

1f56d970f18625db69c9e59463bb655a1f641157de1064be94d9effdf6ada5b5
SHA512

7f8e3f45cd8314685758e66f8ce06945c72af6e7499052558b9ac34beb6a5f70418568ce786c185eaee336bee0cb99f0641e5b63566b362f6dc0d14a724aa712
SSDEEP

3072:Yf+GYrgxI0c5XI/NklH0iNL2Sl8BJoNEWoY46Uolzeih:ndr0I0c5XICuiNLnluOdohPolL

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4140	hkrkzat.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 4140	2824	086_herpa_GS.exe	86
PID 2824 wrote to memory of 4140	2824	086_herpa_GS.exe	86

C:\Users\Admin\AppData\Local\Temp\086_herpa_GS.exe
"C:\Users\Admin\AppData\Local\Temp\086_herpa_GS.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2824
- \Users\Admin\AppData\Local\Temp\hkrkzat.exe
  2⤵
  - Executes dropped EXE
  PID:4140

C:\Users\Admin\AppData\Local\Temp\hkrkzat.exe

Filesize
27KB

MD5
5da8c98136d98dfec4716edd79c7145f

SHA1
ed13af4a0a754b8daee4929134d2ff15ebe053cd

SHA256
58189cbd4e6dc0c7d8e66b6a6f75652fc9f4afc7ce0eba7d67d8c3feb0d5381f

SHA512
6e2b067760ec178cdcc4df04c541ce6940fc2a0cdd36f57f4d6332e38119dbc5e24eb67c11d2c8c8ffeed43533c2dd8b642d2c7c997c392928091b5ccce7582a

Download Submit
memory/4140-2-0x000001C477BF0000-0x000001C477BF1000-memory.dmp

Filesize
4KB

Download