b4541ee1b6d5894950e5bbb76a141c085c5cd5545d39584246c7d775e20cda3a

Analysis

max time kernel
138s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 16:40

Target

f6cb0fecaec769421d785b0e8c5a732a.exe
Size

1.9MB
MD5

f6cb0fecaec769421d785b0e8c5a732a
SHA1

af74b22ce57866a80f17530193799495719151b8
SHA256

b4541ee1b6d5894950e5bbb76a141c085c5cd5545d39584246c7d775e20cda3a
SHA512

94974a9397d52d83f165096877f70caf17c61afba3b3a89009cc02a055c3235148225dd51ce4ec4d82d2b8f136d7318bf4781aa98d4a8ee2f1c849cb4335b860
SSDEEP

49152:Qoa1taC070dc16p+UQZZyBZC09fBwjbe03fn3tHJ:Qoa1taC0bplHqB5w/

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1736	BA09.tmp

Executes dropped EXE 1 IoCs

pid	Process
1736	BA09.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 1736	4904	f6cb0fecaec769421d785b0e8c5a732a.exe	91
PID 4904 wrote to memory of 1736	4904	f6cb0fecaec769421d785b0e8c5a732a.exe	91
PID 4904 wrote to memory of 1736	4904	f6cb0fecaec769421d785b0e8c5a732a.exe	91

C:\Users\Admin\AppData\Local\Temp\f6cb0fecaec769421d785b0e8c5a732a.exe
"C:\Users\Admin\AppData\Local\Temp\f6cb0fecaec769421d785b0e8c5a732a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Users\Admin\AppData\Local\Temp\BA09.tmp
  "C:\Users\Admin\AppData\Local\Temp\BA09.tmp" --splashC:\Users\Admin\AppData\Local\Temp\f6cb0fecaec769421d785b0e8c5a732a.exe 18F86AEC06B747032E8BF5B35CEB6958DDC414F52C4E7BE3AFCDAC411F82F50C4FCFBBEAFD634AF97DF5487A3C7D91162B1F113F1E0A5BAFAEC2EECC434715C4
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1736

C:\Users\Admin\AppData\Local\Temp\BA09.tmp

Filesize
308KB

MD5
c079b5a593e780e49137dc0db226679f

SHA1
51a7a884a0e9e355b08cbb44c95a4519de311a30

SHA256
3e9d7ef131c0a660b45cd6ffab29c2bcbcf3932a44a9734ccd39a82e478cc7af

SHA512
f0acfa64c37eec2730914343c16b26d606ace283de6c6f3838b3e36ae5faec4ed09fbdbbaea5e0a496932bdc1d660e454be0525274fbb10862053bf812ea9b84

Download Submit
C:\Users\Admin\AppData\Local\Temp\BA09.tmp

Filesize
451KB

MD5
abcdfd54955c8a42a6ac61200662735f

SHA1
dfc9ecbf26c8f11cbfb2e999d947c0e471740217

SHA256
cb4e9dbbbfe3120bc942c4f960c6cc503753b63542c5fbb657f4b44ca042f220

SHA512
caa8b59b8f45fb4a35cef38c47902893cc4f373e40300297119b758583461b61876a18c808a5de7c91b957eac466553ea5bb8d384aafa5ca1a689eecf9bd4abf

Download Submit
memory/1736-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4904-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download