9625e2ab61630c83f38e3b292c5e21e2302208658ffc1faa38846579bc02e234

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 10:52

Target

18a7f987ba78b7d941e85dc001275d3f.exe
Size

744KB
MD5

18a7f987ba78b7d941e85dc001275d3f
SHA1

78bcb4667416e6181499f1ac478e0802a91e16d8
SHA256

9625e2ab61630c83f38e3b292c5e21e2302208658ffc1faa38846579bc02e234
SHA512

aa07e35f79729571b97c48a52206de05e5ba40a503b5cc9ba4d96945d70543a207d7e10cf0f6b943fcdc1556e99b9c95933ad33bfdc2f4f1bf53dc96dc91a7d9
SSDEEP

12288:uaHc64b888888888888W888888888889jscV7TdjL47zdU5imqsX3sv33rD+zG/6:F86IIW7uvmQBsHUezG/aYFkJR30F6rpb

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2968	18a7f987ba78b7d941e85dc001275d3f.tmp

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	41	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2968	1700	18a7f987ba78b7d941e85dc001275d3f.exe	91
PID 1700 wrote to memory of 2968	1700	18a7f987ba78b7d941e85dc001275d3f.exe	91
PID 1700 wrote to memory of 2968	1700	18a7f987ba78b7d941e85dc001275d3f.exe	91

C:\Users\Admin\AppData\Local\Temp\18a7f987ba78b7d941e85dc001275d3f.exe
"C:\Users\Admin\AppData\Local\Temp\18a7f987ba78b7d941e85dc001275d3f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Users\Admin\AppData\Local\Temp\is-94VCO.tmp\18a7f987ba78b7d941e85dc001275d3f.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-94VCO.tmp\18a7f987ba78b7d941e85dc001275d3f.tmp" /SL5="$12004E,371795,121344,C:\Users\Admin\AppData\Local\Temp\18a7f987ba78b7d941e85dc001275d3f.exe"
  2⤵
  - Executes dropped EXE
  PID:2968

C:\Users\Admin\AppData\Local\Temp\is-94VCO.tmp\18a7f987ba78b7d941e85dc001275d3f.tmp

Filesize
1.1MB

MD5
34acc2bdb45a9c436181426828c4cb49

SHA1
5adaa1ac822e6128b8d4b59a54d19901880452ae

SHA256
9c81817acd4982632d8c7f1df3898fca1477577738184265d735f49fc5480f07

SHA512
134ff4022571efd46f7a62e99b857ebe834e9916c786345908010f9e1fb90be226b740ddee16ae9290fe45c86be7238c4555e422abe66a461d11545e19734beb

Download Submit
memory/1700-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1700-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2968-5-0x0000000000850000-0x0000000000851000-memory.dmp

Filesize
4KB

Download
memory/2968-8-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/2968-10-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/2968-11-0x0000000000850000-0x0000000000851000-memory.dmp

Filesize
4KB

Download