fd533f74afd76517edd7924d5368d2f3410942cadb974ed8eff6d63b64bbbd54

Analysis

max time kernel
142s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 13:45

Target

abeac3414a2f6c21364aba2502ab5b6e.exe
Size

1.1MB
MD5

abeac3414a2f6c21364aba2502ab5b6e
SHA1

dfeed6ab307c4e5bdd03ba39fa1a5cddae14c7be
SHA256

fd533f74afd76517edd7924d5368d2f3410942cadb974ed8eff6d63b64bbbd54
SHA512

fcf9e05634459796e0952c460b6391d9572174df2e101d2cbe6bf937d48d112a52a1ef81b119a11d48b79b9b6a57fcb5b9d5a0df16cfbe814a701a5017dbde53
SSDEEP

24576:SypW9SgLNZaOdcTMuUvxIgVHLWKY855u+KetHKq/AQAyW/yD0:St9SgLNZa6xIm9Y8H9TAQZW/e0

Score

7^/10

Deletes itself 1 IoCs

pid	Process
536	4333.tmp

Executes dropped EXE 1 IoCs

pid	Process
536	4333.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 536	3156	abeac3414a2f6c21364aba2502ab5b6e.exe	21
PID 3156 wrote to memory of 536	3156	abeac3414a2f6c21364aba2502ab5b6e.exe	21
PID 3156 wrote to memory of 536	3156	abeac3414a2f6c21364aba2502ab5b6e.exe	21

C:\Users\Admin\AppData\Local\Temp\abeac3414a2f6c21364aba2502ab5b6e.exe
"C:\Users\Admin\AppData\Local\Temp\abeac3414a2f6c21364aba2502ab5b6e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Users\Admin\AppData\Local\Temp\4333.tmp
  "C:\Users\Admin\AppData\Local\Temp\4333.tmp" --pingC:\Users\Admin\AppData\Local\Temp\abeac3414a2f6c21364aba2502ab5b6e.exe 7F6CD43C718ED2D374D49C2D898254D36C123EE168C2EA480AD780E167B70352332C465604640B77E6ED966C65D86C30463CFD2F9730EAA78FF5990298515799
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:536

C:\Users\Admin\AppData\Local\Temp\4333.tmp

Filesize
9KB

MD5
4ec1eaf7266a9b7496e3705f229f8aad

SHA1
814bbcb2dee404c9cbfae5e79dba155ea34efcf3

SHA256
17b9111bfe0dd40721cb867643c55fb389790d0a2a5489bd6dd07e599897ba21

SHA512
6d63fae90b2ce63a8a94de4156770d139b9a975924fa1de8fc3759b2443a20861b8320f52da0c2eb6d0404439eaae2782f444baab4c32ebb3cf29e49b403f3e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\4333.tmp

Filesize
16KB

MD5
dd73868e43ccb35160930b911dcd8d1d

SHA1
9b6e319d99d0501c752209b9ca67a7700ae93a20

SHA256
03fae4c52d1ca24668abd60f3293b101790acf4164bb2736ddce91ee4b32c52c

SHA512
893c96d666f3b24e4f69558051a563997c08a86220b8ca671494dca9755ed520283937a3d11b321b6fdfb04eaa65dc1d2873b67dc6d456b08f8860ec01b560d8

Download Submit
memory/536-8-0x0000000000F40000-0x0000000000F90000-memory.dmp

Filesize
320KB

Download
memory/536-7-0x0000000000640000-0x0000000000785000-memory.dmp

Filesize
1.3MB

Download
memory/3156-0-0x0000000000010000-0x0000000000155000-memory.dmp

Filesize
1.3MB

Download
memory/3156-2-0x0000000002500000-0x0000000002550000-memory.dmp

Filesize
320KB

Download