d4b6e9571853d008360d20f6609b165bd6f17046b896fbe46125c7dea64fe3d7

Analysis

max time kernel
135s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19-12-2023 10:38

Target

09f84447d222a49e10aebeb126a313f8.exe
Size

1.5MB
MD5

09f84447d222a49e10aebeb126a313f8
SHA1

a6e4128622294e117f265f8db32b88e3e91b8c25
SHA256

d4b6e9571853d008360d20f6609b165bd6f17046b896fbe46125c7dea64fe3d7
SHA512

5dd96ea3974d88e941452ae5f6f9231d2a3be4853aa399a6caa0f7152ba639374db5106f5f8cd120422a208485e782c27da43300726ba71600887c596d1b7630
SSDEEP

24576:e9dG37Vk0R07Qanm9k4nIiWIGpzsvHvO1IAd6D2z38xJRmXEz:lrq0R07QQmaP1pRpgDiGRmUz

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2580	47A8.tmp

Executes dropped EXE 1 IoCs

pid	Process
2580	47A8.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3224 wrote to memory of 2580	3224	09f84447d222a49e10aebeb126a313f8.exe	90
PID 3224 wrote to memory of 2580	3224	09f84447d222a49e10aebeb126a313f8.exe	90
PID 3224 wrote to memory of 2580	3224	09f84447d222a49e10aebeb126a313f8.exe	90

C:\Users\Admin\AppData\Local\Temp\09f84447d222a49e10aebeb126a313f8.exe
"C:\Users\Admin\AppData\Local\Temp\09f84447d222a49e10aebeb126a313f8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Users\Admin\AppData\Local\Temp\47A8.tmp
  "C:\Users\Admin\AppData\Local\Temp\47A8.tmp" --pingC:\Users\Admin\AppData\Local\Temp\09f84447d222a49e10aebeb126a313f8.exe 4522AAA825FAC75B513C27CC32E3B38B2B6C9CA3C370F3157D026A08965D16B4846062510C8AE3CC7672AB871604DF58BBDA24FC0E960D40193238623F44B4BE
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2580

C:\Users\Admin\AppData\Local\Temp\47A8.tmp

Filesize
1.4MB

MD5
96cb9d80a601fba6f68bd09e1c48f80e

SHA1
5e0de2725d581cc5a3ce5a9a765b593035b4068f

SHA256
a64f44d9a16d8dc3ce7bad6e5bca16a2135cd3cf49fcd4c11daf7541dd6435a4

SHA512
78c6abb53f9865dfa0186eeaf8a98234b0260e28d33963501f4473d910b62ee9af8ee403cca1f8800d8c6df4e96f370d44d5f21be78df61933eea3d8f5b90b30

Download Submit
C:\Users\Admin\AppData\Local\Temp\47A8.tmp

Filesize
1.5MB

MD5
0d203785ee1ed736c4b68916e329cf4a

SHA1
bbcc9c6f5706923d65952d10305dc7380317cedb

SHA256
3c1ca27f304d671956f8446221b55bd0af4ec39bb54930c295c4e84fee70e13b

SHA512
0456bad3ab8cdfc76f2adbb23a51d1a7724913a563f1009ab7eb7d3602ff0812aa842209cc19759b0eda0ab92e66ff63f230ada78d8c6e4b8bc3a862bdd3af30

Download Submit
memory/2580-7-0x0000000000DF0000-0x0000000000FBE000-memory.dmp

Filesize
1.8MB

Download
memory/2580-9-0x00000000024D0000-0x000000000254A000-memory.dmp

Filesize
488KB

Download
memory/3224-0-0x0000000000900000-0x0000000000ACE000-memory.dmp

Filesize
1.8MB

Download
memory/3224-2-0x0000000002AE0000-0x0000000002B5A000-memory.dmp

Filesize
488KB

Download