8a46b2ed00082ff612029a3e57c58c3403d74d417dd8351d93eb16c8fb2e436b

Analysis

max time kernel
1s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2023 13:25

Target

723b77b0268c4f9f619e86da1af0821b.exe
Size

208KB
MD5

723b77b0268c4f9f619e86da1af0821b
SHA1

ea95bdbd55254ca58a1030797b92e90b4007d760
SHA256

8a46b2ed00082ff612029a3e57c58c3403d74d417dd8351d93eb16c8fb2e436b
SHA512

732d2fe05f5f0b20efc2e1e2394f7e76a85fa555e6701e0decc5aef6b43cf8200f85163ea1ff903fa5cc4cb9fbaa7b4eca12cc09f46f789316113e12cf358a1c
SSDEEP

6144:dlGRgXm15iZsw3LpUNejT/0qTMZN9CIt8k3tE/:uv168oo5Zj5t8kdE/

Score

7^/10

Executes dropped EXE 2 IoCs

pid	Process
3712	u.dll
2868	mpress.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 4560	4840	723b77b0268c4f9f619e86da1af0821b.exe	23
PID 4840 wrote to memory of 4560	4840	723b77b0268c4f9f619e86da1af0821b.exe	23
PID 4840 wrote to memory of 4560	4840	723b77b0268c4f9f619e86da1af0821b.exe	23
PID 4560 wrote to memory of 3712	4560	cmd.exe	21
PID 4560 wrote to memory of 3712	4560	cmd.exe	21
PID 4560 wrote to memory of 3712	4560	cmd.exe	21
PID 3712 wrote to memory of 2868	3712	u.dll	17
PID 3712 wrote to memory of 2868	3712	u.dll	17
PID 3712 wrote to memory of 2868	3712	u.dll	17
PID 4560 wrote to memory of 3900	4560	cmd.exe	18
PID 4560 wrote to memory of 3900	4560	cmd.exe	18
PID 4560 wrote to memory of 3900	4560	cmd.exe	18

C:\Users\Admin\AppData\Local\Temp\723b77b0268c4f9f619e86da1af0821b.exe
"C:\Users\Admin\AppData\Local\Temp\723b77b0268c4f9f619e86da1af0821b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\46FC.tmp\vir.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4560

C:\Users\Admin\AppData\Local\Temp\4759.tmp\mpress.exe
"C:\Users\Admin\AppData\Local\Temp\4759.tmp\mpress.exe" "C:\Users\Admin\AppData\Local\Temp\exe475A.tmp"
1⤵
- Executes dropped EXE
PID:2868

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1396

memory/2868-57-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2868-63-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4840-0-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/4840-1-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/4840-71-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download