9c9e7f161f882933434c47bc26490c552443728f24ed3cb2cc309f4bb71c455a

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/12/2023, 22:02

Target

b015527c9eb51bfc92d97fe8a0b4ede7.exe
Size

1.9MB
MD5

b015527c9eb51bfc92d97fe8a0b4ede7
SHA1

bcaa3f72adb4448527b29054d25d5c19e50b0295
SHA256

9c9e7f161f882933434c47bc26490c552443728f24ed3cb2cc309f4bb71c455a
SHA512

5662a5ab0b8be7ca8b00be316f90b3dba08c825c86a4b4b67a911f2c7a648fed3a6f5caebddf98a6cfe10df24a75d5e182e7efe0789600de7ba187f6354f5c1b
SSDEEP

49152:Qoa1taC070dHDGx/kPjMYIgfE1tW9xVd1uEVf:Qoa1taC0kDGlkbMLwELuxn0I

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2012	472B.tmp

Executes dropped EXE 1 IoCs

pid	Process
2012	472B.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 2012	4100	b015527c9eb51bfc92d97fe8a0b4ede7.exe	90
PID 4100 wrote to memory of 2012	4100	b015527c9eb51bfc92d97fe8a0b4ede7.exe	90
PID 4100 wrote to memory of 2012	4100	b015527c9eb51bfc92d97fe8a0b4ede7.exe	90

C:\Users\Admin\AppData\Local\Temp\b015527c9eb51bfc92d97fe8a0b4ede7.exe
"C:\Users\Admin\AppData\Local\Temp\b015527c9eb51bfc92d97fe8a0b4ede7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Users\Admin\AppData\Local\Temp\472B.tmp
  "C:\Users\Admin\AppData\Local\Temp\472B.tmp" --splashC:\Users\Admin\AppData\Local\Temp\b015527c9eb51bfc92d97fe8a0b4ede7.exe 6984442DAE63B712D848080A1E1CC9E2572D0D192A6BFAF37A03A0218590F1BBA77D65C3CD33804C346CB8362B41C03FF83903FF345DA78082EF189E584FFB8D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2012

C:\Users\Admin\AppData\Local\Temp\472B.tmp

Filesize
1.9MB

MD5
3ee4f80863dd4de35df7d8970ca56958

SHA1
50becd4dfc6fb1e82e89607fba26f814bf004449

SHA256
ba6896da08f8382c4b30dd434ce46c7ab7f1991f0ba3ed0899c3e4387cc51938

SHA512
80c47396a0d379bc7bd2f80f32ef48e2b3d605f821757db6389531700f9bfede2716c53dceaa0902e7dfbf8df50a70f229000b528c2e91ee0f8c62e80a7765ac

Download Submit
memory/2012-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4100-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download