cf379926181012bc4a6c65de09d8bc148a4e331a16f071b79ac00cfd86bcf350

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19-12-2023 10:35

Target

0908978b978e5919a1648c483c49db91.exe
Size

1.9MB
MD5

0908978b978e5919a1648c483c49db91
SHA1

ce71e4b5c492002a801926146b33071bdfbf7b08
SHA256

cf379926181012bc4a6c65de09d8bc148a4e331a16f071b79ac00cfd86bcf350
SHA512

ed6e8a991b269d98744fcb5e8ddd8427ef0687b1a385a7f821b9f73b542150c05d4c6cdd5ee9e888d2f5e32dd7e59cd17c25ab7e64ffa602e59ada4cb52b6170
SSDEEP

49152:Qoa1taC070dRdnv2xssm7b001lXSwLnThcWyrESH2gksupZr:Qoa1taC045k9i001lzLnTeWyhNkvp1

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1340	7E38.tmp

Executes dropped EXE 1 IoCs

pid	Process
1340	7E38.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 976 wrote to memory of 1340	976	0908978b978e5919a1648c483c49db91.exe	90
PID 976 wrote to memory of 1340	976	0908978b978e5919a1648c483c49db91.exe	90
PID 976 wrote to memory of 1340	976	0908978b978e5919a1648c483c49db91.exe	90

C:\Users\Admin\AppData\Local\Temp\0908978b978e5919a1648c483c49db91.exe
"C:\Users\Admin\AppData\Local\Temp\0908978b978e5919a1648c483c49db91.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:976
- C:\Users\Admin\AppData\Local\Temp\7E38.tmp
  "C:\Users\Admin\AppData\Local\Temp\7E38.tmp" --splashC:\Users\Admin\AppData\Local\Temp\0908978b978e5919a1648c483c49db91.exe BBB5B6A0C9F61C5F20758E2B4F7EE5B493249B1FDE1CC20632183082C89E4F81B1030CAD986DA5E654BCE0E6640A8D2F2F3B3EE635E96B77B8B3C4D68F420A46
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1340

C:\Users\Admin\AppData\Local\Temp\7E38.tmp

Filesize
684KB

MD5
19e4f295f9d2382cbf5859ce17bcad50

SHA1
fd50dce254468672209106b032492b1043502f56

SHA256
65f5175172fe07f77b9ce68b758883ac8520002a91b0ba99344bb57dab32177a

SHA512
4d386d95971ff2c4243ea78f79be5b5409890ccd86fe5cc4d454e5c77683352c621304025bbd6905dfdc875e0613e85c644ebd3c2720d1091b8da91d63317f15

Download Submit
C:\Users\Admin\AppData\Local\Temp\7E38.tmp

Filesize
977KB

MD5
66b8b070b803b6e2c40083b1ca37e643

SHA1
e80e1f85389cc61a0a51d080d773f1c084cf0ce8

SHA256
3a2f70f9c490c19e05475f93fae75a892b7240528854b7ea7a9451708b3bb7fc

SHA512
992865c1612db751423fe17e492feb2af57acd30942c9e9c6f8746e527e57b1b61ac44d2d2a79ca6adae28d89357f40dd288f09687e5f95f6a0f9d754f321b1f

Download Submit
memory/976-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/1340-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download