5e3277bb7812b040cb6519a47891480564c01b07259ebed90569168ce5b05a80

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19-12-2023 11:29

Target

145b9a0b7c73ee13b7e58cdcba81c9e6.exe
Size

1.9MB
MD5

145b9a0b7c73ee13b7e58cdcba81c9e6
SHA1

1651ffeb4e0df2d3046d59c6c26e68db3a494da6
SHA256

5e3277bb7812b040cb6519a47891480564c01b07259ebed90569168ce5b05a80
SHA512

35205c3eb22f07556a81e092cd04834c32dc94ce0bf3504d78c0aafc874598c4572c7b8ecbcd87cf9718c6ad30f3b655cbad39b1f21777683790946746850521
SSDEEP

49152:Qoa1taC070dEHNhKl6u9XTXtcJrwhFJTwnh3XzH9:Qoa1taC0ZXKtTGUmHr9

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4604	A71D.tmp

Executes dropped EXE 1 IoCs

pid	Process
4604	A71D.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 4604	2160	145b9a0b7c73ee13b7e58cdcba81c9e6.exe	90
PID 2160 wrote to memory of 4604	2160	145b9a0b7c73ee13b7e58cdcba81c9e6.exe	90
PID 2160 wrote to memory of 4604	2160	145b9a0b7c73ee13b7e58cdcba81c9e6.exe	90

C:\Users\Admin\AppData\Local\Temp\145b9a0b7c73ee13b7e58cdcba81c9e6.exe
"C:\Users\Admin\AppData\Local\Temp\145b9a0b7c73ee13b7e58cdcba81c9e6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Users\Admin\AppData\Local\Temp\A71D.tmp
  "C:\Users\Admin\AppData\Local\Temp\A71D.tmp" --splashC:\Users\Admin\AppData\Local\Temp\145b9a0b7c73ee13b7e58cdcba81c9e6.exe FE053888E9AEE591998E6B46C86F992C475D35DCD38E4F7F137C61DECD2C032A5C80888F4C4567A42FE0B4C8F0BF3F4FB8139E29A132038A5433F565B322466B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4604

C:\Users\Admin\AppData\Local\Temp\A71D.tmp

Filesize
1.9MB

MD5
a015ed448ae5101e8d9829be80dff622

SHA1
8129d398723c0d713357f657dc09fd58cec0377c

SHA256
327a4a8410fcc305a0c653cdbf45bbb2089fd7f852c3196060593f56602ec677

SHA512
7de6bafe6718646dbea3c242dc901bc4bf8ac02cbe2827aa86c6293676428243a9b84136ae0117413b77fa573b8a793de9649d20c1bcc00857ae66512ded22a2

Download Submit
memory/2160-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4604-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download