36d18ea06593f69af0ba40c640258c415ef14d28e6db8854f914ffa84c44ccd5

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 13:32

Target

a58a331eb35ed202ac5d706571dac756.exe
Size

1.9MB
MD5

a58a331eb35ed202ac5d706571dac756
SHA1

9c60af8b2d2b98719c6840628c51a5b13c3cc752
SHA256

36d18ea06593f69af0ba40c640258c415ef14d28e6db8854f914ffa84c44ccd5
SHA512

01b3d1601a597a9c98e2ca215b0f150d9ac0be428116cf8ce472e866d0ab3c303db0fdde96884c790820b43fbeee5556fe7f11941deec8e72f2be359527669f4
SSDEEP

49152:Qoa1taC070duADsyPezoKS1QGCMQjBNDIHcsuL7Ct:Qoa1taC0RusUezfpnBNDIHRuLWt

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2208	4D64.tmp

Executes dropped EXE 1 IoCs

pid	Process
2208	4D64.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 2208	2724	a58a331eb35ed202ac5d706571dac756.exe	38
PID 2724 wrote to memory of 2208	2724	a58a331eb35ed202ac5d706571dac756.exe	38
PID 2724 wrote to memory of 2208	2724	a58a331eb35ed202ac5d706571dac756.exe	38

C:\Users\Admin\AppData\Local\Temp\a58a331eb35ed202ac5d706571dac756.exe
"C:\Users\Admin\AppData\Local\Temp\a58a331eb35ed202ac5d706571dac756.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Users\Admin\AppData\Local\Temp\4D64.tmp
  "C:\Users\Admin\AppData\Local\Temp\4D64.tmp" --splashC:\Users\Admin\AppData\Local\Temp\a58a331eb35ed202ac5d706571dac756.exe 265A5796B4C38A554B45CCF8F0DC82DBADC06DD9FF9B4D46D45DCDC3CAAB0689CC802A1E6E2B60FFFCCBE178F849DD018366D7536A39447880A75E238ED6E615
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2208

C:\Users\Admin\AppData\Local\Temp\4D64.tmp

Filesize
958KB

MD5
1b2dca068a0d39b2891f653782646995

SHA1
508ef980816b7903e49e2b06bbf692b4f3123857

SHA256
fbe14327c58bf84310f34dde1653ee8ae2217236467cf06709f1ed00b2400094

SHA512
bd6f1cefc2568816520823b6423c17a72eeb089be58d95bbcb023257c6d152c761b750247f3d9a8d0f217ef7013d0ecf5c8d9f5565a98b002e554629d2c69441

Download Submit
C:\Users\Admin\AppData\Local\Temp\4D64.tmp

Filesize
1.1MB

MD5
594251f6f2a5f0b34a55b79f4db1c016

SHA1
4034b270fafc1e2ba7a54e75d8a9c131e761119a

SHA256
6680bb8821ef72bb475c9646af490f4577bfc78a2c04cdf4caf17c454a6d583b

SHA512
be87ead0eab619096a053212f681fb20c24c8ead41c74914e09bfc167a3c15bbfa744dd9fb199db1efc47548ccc68e62991043a1d4d1893c4747750f75033250

Download Submit
memory/2208-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/2724-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download