417b1565abb57e7437964c40ec03d028cc46ca76e10fe8c933785d89e7cdbb71

Analysis

max time kernel
146s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2023 03:23

Target

4ffc5707a33f075e81a09378b3ffb054.exe
Size

672KB
MD5

4ffc5707a33f075e81a09378b3ffb054
SHA1

d10352ed4a3c7ca2c2492f294fdb9c517c3bee07
SHA256

417b1565abb57e7437964c40ec03d028cc46ca76e10fe8c933785d89e7cdbb71
SHA512

6a6f8554568cba17463c6a7a9c87c779e30f8c475751184000f0cb637491edcc11e7c253acb4468dcb92037f694cd9db61da5efb21381189e8a614cfad29dc66
SSDEEP

12288:5na9ui6GXxK/IgdZ6b0a6mGYjeGG6GlHyBu9jKRHaH9DsFob9tcvS38LCJQBtdGZ:5naEMoAQaz/ZSty0IBG99kS3rJQBtUkq

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3764	4ffc5707a33f075e81a09378b3ffb054.tmp

Loads dropped DLL 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 3764	4696	4ffc5707a33f075e81a09378b3ffb054.exe	17
PID 4696 wrote to memory of 3764	4696	4ffc5707a33f075e81a09378b3ffb054.exe	17
PID 4696 wrote to memory of 3764	4696	4ffc5707a33f075e81a09378b3ffb054.exe	17

C:\Users\Admin\AppData\Local\Temp\4ffc5707a33f075e81a09378b3ffb054.exe
"C:\Users\Admin\AppData\Local\Temp\4ffc5707a33f075e81a09378b3ffb054.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Users\Admin\AppData\Local\Temp\is-0RCHV.tmp\4ffc5707a33f075e81a09378b3ffb054.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-0RCHV.tmp\4ffc5707a33f075e81a09378b3ffb054.tmp" /SL5="$90056,383866,54272,C:\Users\Admin\AppData\Local\Temp\4ffc5707a33f075e81a09378b3ffb054.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3764

memory/3764-7-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/3764-17-0x00000000032C0000-0x00000000032FC000-memory.dmp

Filesize
240KB

Download
memory/3764-38-0x00000000032C0000-0x00000000032FC000-memory.dmp

Filesize
240KB

Download
memory/3764-37-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/3764-42-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/4696-2-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4696-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4696-36-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download