489d55e4b4d9464e38e1306c9165ffeab093f8815433928fd101bc8e0bb59a25

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 14:13

Target

bb20cce9c40afb6ef79aef4d73778211.exe
Size

1.9MB
MD5

bb20cce9c40afb6ef79aef4d73778211
SHA1

6c07d0704f43dc9c73c909c29f8b0f1aed58d99a
SHA256

489d55e4b4d9464e38e1306c9165ffeab093f8815433928fd101bc8e0bb59a25
SHA512

35a424f9578808814ac551346171ea86351fdf24db9e500b1877bba0bf36d16d6bb02c82633f299a4ca3d54e990e727922f3585a984f8c38f5db4db8f9ff403f
SSDEEP

49152:Qoa1taC070dNliT+RYCqz8+ihFrb39WQS/Pq:Qoa1taC02cqK7z8tF1WQSq

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2856	49BB.tmp

Executes dropped EXE 1 IoCs

pid	Process
2856	49BB.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 2856	1448	bb20cce9c40afb6ef79aef4d73778211.exe	91
PID 1448 wrote to memory of 2856	1448	bb20cce9c40afb6ef79aef4d73778211.exe	91
PID 1448 wrote to memory of 2856	1448	bb20cce9c40afb6ef79aef4d73778211.exe	91

C:\Users\Admin\AppData\Local\Temp\bb20cce9c40afb6ef79aef4d73778211.exe
"C:\Users\Admin\AppData\Local\Temp\bb20cce9c40afb6ef79aef4d73778211.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Users\Admin\AppData\Local\Temp\49BB.tmp
  "C:\Users\Admin\AppData\Local\Temp\49BB.tmp" --splashC:\Users\Admin\AppData\Local\Temp\bb20cce9c40afb6ef79aef4d73778211.exe 987D8F482856CA17BC9A8A0CDAC8FFFA4E0A4F2678ACACA504508F8386BE9FAB81BAA5763AF82B8B6459541B6CA106B0CC194F924C13D82D31D26FDB7A581DB1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2856

C:\Users\Admin\AppData\Local\Temp\49BB.tmp

Filesize
873KB

MD5
c2b1e811ca9b15af7dee96dcf7391928

SHA1
8addf4bc92a1c919e3de05079094c07d8eedef06

SHA256
25b17e2deee014a8c939da61822c57dc23e14508f2c7648e53586cc076136d82

SHA512
1012d87336cd54e72f1e0943f94a1845160d3091f510bc9458eee469dafcd74dcd4e322833a48d69fdd4f54e92ebcbe9ed4b467346b1393037f708984f064ce7

Download Submit
C:\Users\Admin\AppData\Local\Temp\49BB.tmp

Filesize
667KB

MD5
036f11058a407bee4f6ae94d9d5f57da

SHA1
3d38cc1574251578d7aeb86d5cd7e5564fbb9d3c

SHA256
f99211081c0d604c50529501b1ddc7f89e0c023489574a015fd7327498c03dd0

SHA512
165ec7c980953b701f9ce1f851ef8829ae0debd8cf54494923cb06a86435725ae03e5756e2d8a813804fb0fc666b93382836c7bfc931c0447cc724696e3ae19e

Download Submit
memory/1448-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/2856-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download