f3aaaa9080a42f6932b9c5ff06854a2eaf623932547f86076a72465128cb0c17

Analysis

max time kernel
148s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 15:39

Target

dc8eb526e678a59a5db7f8ae3a513a0c.exe
Size

2.0MB
MD5

dc8eb526e678a59a5db7f8ae3a513a0c
SHA1

756e5381dad32915f16ce0b6d6c3127bfac46c73
SHA256

f3aaaa9080a42f6932b9c5ff06854a2eaf623932547f86076a72465128cb0c17
SHA512

4f0984a26248690f85544a776d063170a567c9b8a598aec730095821b749b68e3692dd6238498d28ffc5ed3ce4f9010ba1b0bb76abce07029ef4cfef025dcd8a
SSDEEP

24576:dgdhhQGGnnazLpj4VHogiuGYNycAavew3mwmI1nk30sKbcGOyRWEMVM8w8sDDFUd:dqgazxcGYN139lnk30ray05O4

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4180	essdsgq.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\aoattakh\essdsgq.exe	dc8eb526e678a59a5db7f8ae3a513a0c.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 336 wrote to memory of 4180	336	dc8eb526e678a59a5db7f8ae3a513a0c.exe	39
PID 336 wrote to memory of 4180	336	dc8eb526e678a59a5db7f8ae3a513a0c.exe	39
PID 336 wrote to memory of 4180	336	dc8eb526e678a59a5db7f8ae3a513a0c.exe	39

C:\Users\Admin\AppData\Local\Temp\dc8eb526e678a59a5db7f8ae3a513a0c.exe
"C:\Users\Admin\AppData\Local\Temp\dc8eb526e678a59a5db7f8ae3a513a0c.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:336
- C:\Program Files (x86)\aoattakh\essdsgq.exe
  "C:\Program Files (x86)\aoattakh\essdsgq.exe"
  2⤵
  - Executes dropped EXE
  PID:4180

C:\Program Files (x86)\aoattakh\essdsgq.exe

Filesize
264KB

MD5
f7a0926a244331349d3eb8432f8758d2

SHA1
72854ba84738b581450cebcd2458ece684903748

SHA256
0f975d9da7115a44cd17ba2a4fa7147c16bd321d652010604a2544b9806dd8bc

SHA512
1c341f4775d0c1999e2d3eb233570c05037682cdeecd53798ba3171b3c74c51f9a27c2187283d615fa4a34d3c49eae4e5291f40ee25d173269ca0f79a98b38f6

Download Submit
C:\Program Files (x86)\aoattakh\essdsgq.exe

Filesize
176KB

MD5
fbbacd4ba765fe6b8513e51d5be5e25c

SHA1
029b0e437cc75e792f0c2d23b895489da479a21a

SHA256
ea6049bac539b5795b9d70eb1347d43384965f4cb7e9b8c6d3bc01779fdc146c

SHA512
c84d42b5b5e8aae6add102e2384b68b7cddb4fddcfda401d945f1796d6f4ad1d5cf5828c9a237861f4da2362020c864d2d19f0baa019c90320c19ab80ca0da06

Download Submit
memory/336-3-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4180-5-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download