0a5018c8d491f2e5c3824b0276780587941a297a9d22a4c11b38833d818324de

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/12/2023, 10:30

Target

06b8577529e31a422d3bd68fec6f85d1.exe
Size

1.5MB
MD5

06b8577529e31a422d3bd68fec6f85d1
SHA1

90dfcdbbbf0c03504495c50807c3211e922a04ce
SHA256

0a5018c8d491f2e5c3824b0276780587941a297a9d22a4c11b38833d818324de
SHA512

24532b7945f5627f0c1e0612aca77b01b2dc2e23f2909e235377c884206ed0ab401c7ef78782177dfbebb6897305ff8bbca710f938f83f440450df3704664be2
SSDEEP

49152:lrq0R07QQmtMpUAW/8QxHXCUBRxL+WwfrZ:hq0+7W/8QxzBRxL+pN

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4844	41CC.tmp

Executes dropped EXE 1 IoCs

pid	Process
4844	41CC.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 4844	4880	06b8577529e31a422d3bd68fec6f85d1.exe	87
PID 4880 wrote to memory of 4844	4880	06b8577529e31a422d3bd68fec6f85d1.exe	87
PID 4880 wrote to memory of 4844	4880	06b8577529e31a422d3bd68fec6f85d1.exe	87

C:\Users\Admin\AppData\Local\Temp\06b8577529e31a422d3bd68fec6f85d1.exe
"C:\Users\Admin\AppData\Local\Temp\06b8577529e31a422d3bd68fec6f85d1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Users\Admin\AppData\Local\Temp\41CC.tmp
  "C:\Users\Admin\AppData\Local\Temp\41CC.tmp" --pingC:\Users\Admin\AppData\Local\Temp\06b8577529e31a422d3bd68fec6f85d1.exe 38AA5F697B60D66706497AFD667878875DB92F91B3D62FC06533D094C7745EC5AC97F37A419B9AD580242F36352779FF38335F72D302BD11D4232E2DEDDAFF4C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4844

C:\Users\Admin\AppData\Local\Temp\41CC.tmp

Filesize
1.5MB

MD5
33eeba658c98313910d38a2067eaf1be

SHA1
922fd0763ad6c8772021920c5163a9a73505299d

SHA256
c343208eef33dc7a541de92694e72db39fcc43cccb0bcc6e70c4add3b5987594

SHA512
515c597d5709ecd404344ebb13c0f5ae4f3fd5c133f7ca2be0dc866ce7f96221c89eb6a72a051931d2cb02f6283c621a31f2ca8c5c64bf37632b54abd5d3ce35

Download Submit
memory/4844-8-0x0000000002200000-0x000000000227A000-memory.dmp

Filesize
488KB

Download
memory/4844-7-0x00000000005C0000-0x000000000078E000-memory.dmp

Filesize
1.8MB

Download
memory/4880-0-0x00000000009D0000-0x0000000000B9E000-memory.dmp

Filesize
1.8MB

Download
memory/4880-2-0x0000000002CF0000-0x0000000002D6A000-memory.dmp

Filesize
488KB

Download