31ff3188f726f9c63a1d76ccd20db22c4c5701ddd8bcd04c7ab0158ec5ce1511

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 16:32

Target

2d6d1f381d72f3ac76393f9fe35654ef.exe
Size

58KB
MD5

2d6d1f381d72f3ac76393f9fe35654ef
SHA1

10eb7ede1869f3f554a98bc20ce5cd39e4f5b90c
SHA256

31ff3188f726f9c63a1d76ccd20db22c4c5701ddd8bcd04c7ab0158ec5ce1511
SHA512

b1c37f5ed17da285e7c3549b3de1fe5ed31cf338cafbcb149e76d2def52f794fffacda87e7965083ae6fcd2bea674d5a13d64068ac44f7791e3dfc33fd1dd3f1
SSDEEP

768:vCru/f9Iw/E6zy4n8uZ5tUXMJ+fROUmELY2glEbM3j+rd+fpRiTWNReOO1:71Tzy48untU8fOMEI3jyYfPiuO1

Score

1^/10

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 4332	4772	2d6d1f381d72f3ac76393f9fe35654ef.exe	69
PID 4772 wrote to memory of 4332	4772	2d6d1f381d72f3ac76393f9fe35654ef.exe	69
PID 4772 wrote to memory of 4332	4772	2d6d1f381d72f3ac76393f9fe35654ef.exe	69
PID 4332 wrote to memory of 4476	4332	cmd.exe	75
PID 4332 wrote to memory of 4476	4332	cmd.exe	75
PID 4332 wrote to memory of 4476	4332	cmd.exe	75
PID 4476 wrote to memory of 1444	4476	iexpress.exe	91
PID 4476 wrote to memory of 1444	4476	iexpress.exe	91
PID 4476 wrote to memory of 1444	4476	iexpress.exe	91

C:\Users\Admin\AppData\Local\Temp\2d6d1f381d72f3ac76393f9fe35654ef.exe
"C:\Users\Admin\AppData\Local\Temp\2d6d1f381d72f3ac76393f9fe35654ef.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7196.tmp\1.bat" "C:\Users\Admin\AppData\Local\Temp\2d6d1f381d72f3ac76393f9fe35654ef.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Windows\SysWOW64\iexpress.exe
    iexpress /n /q /m C:\Users\Admin\AppData\Local\Temp\popup.sed
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4476
  - - C:\Windows\SysWOW64\makecab.exe
      C:\Windows\SysWOW64\makecab.exe /f "~%TargetName%.DDF"
      4⤵
      PID:1444

C:\Users\Admin\AppData\Local\Temp\7196.tmp\1.bat

Filesize
1KB

MD5
02dba5f37067292355c6d01a57d4ef48

SHA1
7c67ab3f99fbf7a53018dd295d2968c525db83d9

SHA256
8b74c812ba9e6c536da7edd4101e7e0dddeab8355e5aff095dd31b3f00560242

SHA512
12201f949ee3198c8f4b39cc8edf90a114ecf42ddd5383ed0b87e4c78053cd517786dc7af83557e63a0483af74f4c0117d5568441ae761ff6958e758704d602a

Download Submit
C:\Users\Admin\AppData\Local\Temp\popup.sed

Filesize
58KB

MD5
57849ba61aa1cbc0272d5077133284b0

SHA1
2c8d9b153412b1b71f818a4fd0fcc691c60e7c87

SHA256
3da6495259a9a5beb2203e33db24f75068f20303b6a9590c0bd9c8d0bd285739

SHA512
c04d19a53226ea8ecc25e433d4991a59c3a3ddb60ca60d23fbc3c557f799ce382174db6e7c341cae916fa66c0bf724c19eb662db9d4360340b38e93fe3ffd663

Download Submit
C:\Users\Admin\AppData\Local\Temp\~%TargetName%.DDF

Filesize
724B

MD5
c3ca008abd6997c4b036a7e8be75cb2c

SHA1
05f7a3527bb04c691b08f040f562582035398829

SHA256
29ef6bf47dcc8c67f1abe1b269d3518d6a4ebe125daa1ea460779638cb9782a3

SHA512
bee0baf3cb83144239077f99f5ca2a6ca7b618f7f51a53e03613ae697e8bc76fa28f5d006296b469be8e1fffeeb35668b5fe87b260b1380cc003815ea9efb083

Download Submit