b88d7d8c53bb43c130017bcaaa9934a43cdf6b98cc4b49ded6b3968560ae52c2

Analysis

max time kernel
151s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 22:52

Target

1731951de2fc83f47a9e066df2f40d38.exe
Size

1.5MB
MD5

1731951de2fc83f47a9e066df2f40d38
SHA1

529a755044dee0a498fbee0922d56eb4ee96be70
SHA256

b88d7d8c53bb43c130017bcaaa9934a43cdf6b98cc4b49ded6b3968560ae52c2
SHA512

acf7a6345c82338cf649ea8c207680579d938c16093efd3aa6a3ef45a1ed6a5c9168eab2fdf34dbc901bc1c13b6196d789a2522ee067850aac4e7645f9a671fd
SSDEEP

49152:lrq0R07QQm0XvdZzmULaRHA/deViynVOlJIt:hq0+7DXFNmDRpViyVOwt

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3480	F8B.tmp

Executes dropped EXE 1 IoCs

pid	Process
3480	F8B.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 3480	4076	1731951de2fc83f47a9e066df2f40d38.exe	91
PID 4076 wrote to memory of 3480	4076	1731951de2fc83f47a9e066df2f40d38.exe	91
PID 4076 wrote to memory of 3480	4076	1731951de2fc83f47a9e066df2f40d38.exe	91

C:\Users\Admin\AppData\Local\Temp\1731951de2fc83f47a9e066df2f40d38.exe
"C:\Users\Admin\AppData\Local\Temp\1731951de2fc83f47a9e066df2f40d38.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Users\Admin\AppData\Local\Temp\F8B.tmp
  "C:\Users\Admin\AppData\Local\Temp\F8B.tmp" --pingC:\Users\Admin\AppData\Local\Temp\1731951de2fc83f47a9e066df2f40d38.exe 3EE4ECD65DBF331F45A8E1E9BDC47C83E279C7E87C769DEE66B2DF70FCB1D35051EA1D493CA38E712B1CDAFE6C80E28B9817EAE055733B4B2E15F469445E91A7
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3480

C:\Users\Admin\AppData\Local\Temp\F8B.tmp

Filesize
144KB

MD5
f4d2023e6928583f9177bc57d5410092

SHA1
f53899f47cc291f41a4ae61f8ac34b6f16a257b2

SHA256
9ab2441e2987d76de8bd3883ecbae8cd68815ec32ae3df85b3fa17eab23dbe68

SHA512
b3a68cabd83160b44de57ed824307778b8f4e3f622aa34ada82bd8f591dfcd219a78fa11d5fe0a6556919627287eb706de312d1ea64772235c80e6ae0b0cf9d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\F8B.tmp

Filesize
1.5MB

MD5
004da63f093e2e592ea97b77eee28e01

SHA1
f7b8a838a6aea28a5a75b424283f5143b2d843f8

SHA256
b856bf60e6725c7fe53134346cd77af943d098bf73b039f75b8358d79e507485

SHA512
3705b956bcbb76f20e0fdb898190f35ee5be19c83469075f5cfb6d6c79f5ed425073503bd4035e65cdb6d0f21de56c5eec4a1bf1f79cc2765f7507bf26855ffc

Download Submit
memory/3480-7-0x0000000000940000-0x0000000000B0E000-memory.dmp

Filesize
1.8MB

Download
memory/4076-1-0x0000000002370000-0x00000000023EA000-memory.dmp

Filesize
488KB

Download
memory/4076-0-0x0000000000B90000-0x0000000000D5E000-memory.dmp

Filesize
1.8MB

Download