00037f4f0fa49cbafece13b48e6542418e412c4fa7ccf665a65900fbce68687a

Analysis

max time kernel
157s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 16:09

Target

2bf58c0e56fd6a4619ad1a5d5c7960dc.exe
Size

1.8MB
MD5

2bf58c0e56fd6a4619ad1a5d5c7960dc
SHA1

621c4b8ff0787d86c14747b840803ba779bc8235
SHA256

00037f4f0fa49cbafece13b48e6542418e412c4fa7ccf665a65900fbce68687a
SHA512

1211bc7874bbccbe634468e3c36a188c6ac0d9a564b1e82b852f726698c98d86d065a09838e44d0dad99761c1b63bec10e000ad3f935b75f80cf19ef54620c98
SSDEEP

49152:f21EAhfG8EZl+4AIXLTSG850gbPAhoDk3Xd1qapcqp:+eAbEZlRCiEAODGXd1ZL

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1636	2bf58c0e56fd6a4619ad1a5d5c7960dc.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 1636	4612	2bf58c0e56fd6a4619ad1a5d5c7960dc.exe	88
PID 4612 wrote to memory of 1636	4612	2bf58c0e56fd6a4619ad1a5d5c7960dc.exe	88
PID 4612 wrote to memory of 1636	4612	2bf58c0e56fd6a4619ad1a5d5c7960dc.exe	88

C:\Users\Admin\AppData\Local\Temp\2bf58c0e56fd6a4619ad1a5d5c7960dc.exe
"C:\Users\Admin\AppData\Local\Temp\2bf58c0e56fd6a4619ad1a5d5c7960dc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Users\Admin\AppData\Local\Temp\is-7JK0J.tmp\2bf58c0e56fd6a4619ad1a5d5c7960dc.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-7JK0J.tmp\2bf58c0e56fd6a4619ad1a5d5c7960dc.tmp" /SL5="$9003E,1596798,54272,C:\Users\Admin\AppData\Local\Temp\2bf58c0e56fd6a4619ad1a5d5c7960dc.exe"
  2⤵
  - Executes dropped EXE
  PID:1636

C:\Users\Admin\AppData\Local\Temp\is-7JK0J.tmp\2bf58c0e56fd6a4619ad1a5d5c7960dc.tmp

Filesize
695KB

MD5
620f32e56b46e90e8aee43febc59f6e3

SHA1
d5edd63dd1390a1420b85f746e12a66625ae9354

SHA256
bcc9d63213012bf25a37f48015e5f755d359f3b08d05d35319b03b4a72710730

SHA512
8a9d2a2eb3891265cec379978399ad6c9b4bf3e12e0f381946b4390621b943b97fa04fbb87ad628652bd765b706eb2ff56001f24de24e9bcc487a59ca2f07d9c

Download Submit
memory/1636-7-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/1636-14-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1636-17-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/4612-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4612-2-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4612-13-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download