fa0bdffbd4ba7150dcb15ac494e7f25a9aab600c319321d829664a7be8030259

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 04:52

Target

691d859047c536833ea537bce032fcf5.exe
Size

1.9MB
MD5

691d859047c536833ea537bce032fcf5
SHA1

6917d721d6999fcb5362430d90319c899f776e69
SHA256

fa0bdffbd4ba7150dcb15ac494e7f25a9aab600c319321d829664a7be8030259
SHA512

1b29b3397d6592e64f2b516a4628fcffbbc8403dc73c4836573ea75833c67ac97436695b9f7d9aa45a7fe9ba53f3dd068a6568405b68fffb54e2c711136b44fe
SSDEEP

24576:N2oo60HPdt+1CRiY2eOBvcj3u10dISzC420WX9PxdubH63HX4asBhxi44RB8Q4b7:Qoa1taC070d9zyXdqyotrP+C8ow4EAN

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4800	77D0.tmp

Executes dropped EXE 1 IoCs

pid	Process
4800	77D0.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 4800	4140	691d859047c536833ea537bce032fcf5.exe	91
PID 4140 wrote to memory of 4800	4140	691d859047c536833ea537bce032fcf5.exe	91
PID 4140 wrote to memory of 4800	4140	691d859047c536833ea537bce032fcf5.exe	91

C:\Users\Admin\AppData\Local\Temp\691d859047c536833ea537bce032fcf5.exe
"C:\Users\Admin\AppData\Local\Temp\691d859047c536833ea537bce032fcf5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Users\Admin\AppData\Local\Temp\77D0.tmp
  "C:\Users\Admin\AppData\Local\Temp\77D0.tmp" --splashC:\Users\Admin\AppData\Local\Temp\691d859047c536833ea537bce032fcf5.exe 1C4DD86191DA8CE687B8965D29112D0EC4122E586681889E64E1B518F62316DB980593442E6D37F6CA1DBA66F1E9900AAF19687B08244561C92DAF573A7F614D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4800

C:\Users\Admin\AppData\Local\Temp\77D0.tmp

Filesize
1.7MB

MD5
9b581aace955d56983b07b3aa2fec63d

SHA1
12e5e04816460659e4cf28df828426b3d78998e9

SHA256
f1e8568fdd94c2a3affaeca82158f8839e2ac74dd56505e99682f7d111ed700b

SHA512
e8d02f0c76c2d2e6aeb40f7249555cef627f7f036e78a84f27c45da8600c9d8bce114223ed1df381054edc707e0e4a61524910e3a4333d7b01e1310f6b6bda64

Download Submit
C:\Users\Admin\AppData\Local\Temp\77D0.tmp

Filesize
1.8MB

MD5
9cf4f6c03c86b7ba9d31765911f59205

SHA1
7bd122db1a91c945a9b53e71bf138a2da3dbf0f1

SHA256
dbc7b313558bbcd832803163b690433dd44c0ef13742cab581c47480d1ae8726

SHA512
a857e7db846113497d655d7cd290fe1736bf16fec9a04a22af7b48f6b0282cb104accff4a32fe95dfc9f146eaef4320d8597146ebf8580bc14a9afdc6e06c69a

Download Submit
memory/4140-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4800-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download