c6e68c7d923126e0c344dc904fbbe24aab1ba86aabb83d83e711d6892cbe751c

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 15:47

Target

2a8232f457d79d83a08dd75517b0bb03.exe
Size

20KB
MD5

2a8232f457d79d83a08dd75517b0bb03
SHA1

cb6ec4f67494fc3b94eb2ab13447317c71f62b6e
SHA256

c6e68c7d923126e0c344dc904fbbe24aab1ba86aabb83d83e711d6892cbe751c
SHA512

fc046bdaf1f726e21ec90cadfb6ffb8bc5acbfc4143c50d347516958502a30dde52daee7349f914e763a8e9b98fdde599080c5864b2c7d0f68ab00d9d5163efb
SSDEEP

192:e0PcnaRc43+IO8p+Z8Cnzk8zEORsVz8p0WDss2DtYB9OZag2:7EaR3uVzwV4p07s2m9Nx

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3592	~DF8BE4.tmp

Executes dropped EXE 1 IoCs

pid	Process
3592	~DF8BE4.tmp

Suspicious behavior: LoadsDriver 10 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 3592	560	2a8232f457d79d83a08dd75517b0bb03.exe	96
PID 560 wrote to memory of 3592	560	2a8232f457d79d83a08dd75517b0bb03.exe	96
PID 560 wrote to memory of 3592	560	2a8232f457d79d83a08dd75517b0bb03.exe	96

C:\Users\Admin\AppData\Local\Temp\2a8232f457d79d83a08dd75517b0bb03.exe
"C:\Users\Admin\AppData\Local\Temp\2a8232f457d79d83a08dd75517b0bb03.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:560
- C:\Users\Admin\AppData\Local\Temp\~DF8BE4.tmp
  C:\Users\Admin\AppData\Local\Temp\~DF8BE4.tmp PID:576 EXE:"C:\Users\Admin\AppData\Local\Temp\2a8232f457d79d83a08dd75517b0bb03.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3592

C:\Users\Admin\AppData\Local\Temp\~DF8BE4.tmp

Filesize
20KB

MD5
2a8232f457d79d83a08dd75517b0bb03

SHA1
cb6ec4f67494fc3b94eb2ab13447317c71f62b6e

SHA256
c6e68c7d923126e0c344dc904fbbe24aab1ba86aabb83d83e711d6892cbe751c

SHA512
fc046bdaf1f726e21ec90cadfb6ffb8bc5acbfc4143c50d347516958502a30dde52daee7349f914e763a8e9b98fdde599080c5864b2c7d0f68ab00d9d5163efb

Download Submit