af41294465f51795eb27e69559e32673eeacb0ef8c80ff2882ecc63e95d87c8b

Analysis

max time kernel
154s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
17/11/2023, 11:51

Target

af41294465f51795eb27e69559e32673eeacb0ef8c80ff2882ecc63e95d87c8b.exe
Size

283KB
MD5

463a1260b1660f53064ef7ef13f7ea83
SHA1

c933d607f121d111a4f10d90e08b397e4b6ee734
SHA256

af41294465f51795eb27e69559e32673eeacb0ef8c80ff2882ecc63e95d87c8b
SHA512

33ca39429012588f27b7882316c29873ad9430d366a19cf73f96e124834cfbcf722ac4f7bbf8a54dfb74b1081d8abd907c49a2c9eeece83a713dfd887bae81d3
SSDEEP

6144:RImP78oPMFXltEAYI/x+R9RmZO19iEBThpYk:XPQoPMF8CMp2y9iCTbY

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
420	SomposableShell.v77.619.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 420	4732	af41294465f51795eb27e69559e32673eeacb0ef8c80ff2882ecc63e95d87c8b.exe	90
PID 4732 wrote to memory of 420	4732	af41294465f51795eb27e69559e32673eeacb0ef8c80ff2882ecc63e95d87c8b.exe	90

C:\Users\Admin\AppData\Local\Temp\af41294465f51795eb27e69559e32673eeacb0ef8c80ff2882ecc63e95d87c8b.exe
"C:\Users\Admin\AppData\Local\Temp\af41294465f51795eb27e69559e32673eeacb0ef8c80ff2882ecc63e95d87c8b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Users\Admin\AppData\Local\Temp\SomposableShell.v77.619.exe
  /c --Se
  2⤵
  - Executes dropped EXE
  PID:420

C:\Users\Admin\AppData\Local\Temp\SomposableShell.v77.619.exe

Filesize
283KB

MD5
463a1260b1660f53064ef7ef13f7ea83

SHA1
c933d607f121d111a4f10d90e08b397e4b6ee734

SHA256
af41294465f51795eb27e69559e32673eeacb0ef8c80ff2882ecc63e95d87c8b

SHA512
33ca39429012588f27b7882316c29873ad9430d366a19cf73f96e124834cfbcf722ac4f7bbf8a54dfb74b1081d8abd907c49a2c9eeece83a713dfd887bae81d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\SomposableShell.v77.619.exe

Filesize
283KB

MD5
463a1260b1660f53064ef7ef13f7ea83

SHA1
c933d607f121d111a4f10d90e08b397e4b6ee734

SHA256
af41294465f51795eb27e69559e32673eeacb0ef8c80ff2882ecc63e95d87c8b

SHA512
33ca39429012588f27b7882316c29873ad9430d366a19cf73f96e124834cfbcf722ac4f7bbf8a54dfb74b1081d8abd907c49a2c9eeece83a713dfd887bae81d3

Download Submit
memory/420-4-0x0000000180000000-0x000000018003C000-memory.dmp

Filesize
240KB

Download