4a2b844ea926332df491a2b9e801a3867f28167846a024fcee4a528a41c6b11a

Analysis

max time kernel
1s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 01:12

Target
1f94557f0b2bc3a327ec2a1032774705.exe
Size 208KB
Sample231225-bksp2shdf7
SHA256 4a2b844ea926332df491a2b9e801a3867f28167846a024fcee4a528a41c6b11a
MD5 1f94557f0b2bc3a327ec2a1032774705
SHA1 11c458aef5d8657fe13d2d60a729910372c6f767
SHA512 cb441cab97164b9b84932410c3321ae31134668bbbbc2db9673c3f5c8eec58dfe1b03bf0f7a504882375230c9b63007380fabf8aa1047313682999bda6ee0dc7
SSDEEP 6144:CldP0X/pw8nBjUQa+f7tI0uo1cX5h3/wR4vHBLsdtR:ysvpBnNaOMJh3oR4vHUR
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 2 IoCs

pid	Process
2152	u.dll
1276	mpress.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 1412	4556	1f94557f0b2bc3a327ec2a1032774705.exe	21
PID 4556 wrote to memory of 1412	4556	1f94557f0b2bc3a327ec2a1032774705.exe	21
PID 4556 wrote to memory of 1412	4556	1f94557f0b2bc3a327ec2a1032774705.exe	21
PID 1412 wrote to memory of 2152	1412	cmd.exe	20
PID 1412 wrote to memory of 2152	1412	cmd.exe	20
PID 1412 wrote to memory of 2152	1412	cmd.exe	20
PID 2152 wrote to memory of 1276	2152	u.dll	17
PID 2152 wrote to memory of 1276	2152	u.dll	17
PID 2152 wrote to memory of 1276	2152	u.dll	17
PID 1412 wrote to memory of 4032	1412	cmd.exe	16
PID 1412 wrote to memory of 4032	1412	cmd.exe	16
PID 1412 wrote to memory of 4032	1412	cmd.exe	16

C:\Users\Admin\AppData\Local\Temp\1f94557f0b2bc3a327ec2a1032774705.exe
"C:\Users\Admin\AppData\Local\Temp\1f94557f0b2bc3a327ec2a1032774705.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3E22.tmp\vir.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1412

C:\Users\Admin\AppData\Local\Temp\3EAF.tmp\mpress.exe
"C:\Users\Admin\AppData\Local\Temp\3EAF.tmp\mpress.exe" "C:\Users\Admin\AppData\Local\Temp\exe3ECF.tmp"
1⤵
- Executes dropped EXE
PID:1276

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1776

memory/1276-56-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1276-62-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4556-0-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/4556-1-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/4556-70-0x0000000000400000-0x00000000004BF000-memory.dmp

Download