97d8e81eda16d149a769f81a9c74a172970944854d32d59a65bf97b0cd97db7e

Analysis

max time kernel
151s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 18:30

Target

0083cdba3deee931b709d91c77561be3.exe
Size

405KB
MD5

0083cdba3deee931b709d91c77561be3
SHA1

dfe93c3c2b3632d0e7624a0251ab88df8aa0b7ba
SHA256

97d8e81eda16d149a769f81a9c74a172970944854d32d59a65bf97b0cd97db7e
SHA512

23464d4ff57e1112781ddbc4d307f929795cb1055a09c55650d3229c56846381ce06114ad98e44a2cdc7fef4adfcbe8230aa8b5b9f8c5f1ad585917a9c6f0f84
SSDEEP

6144:MTykDONo0jv7IoPfeq1ZzxRJbL7f5LAh36rSLL64j7W4SPHREa0KmmfL6:MLry/neyx7f/A64j7PSfREKLm

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2488	jnapz.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\nsbi\jnapz.exe	0083cdba3deee931b709d91c77561be3.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 348 wrote to memory of 2488	348	0083cdba3deee931b709d91c77561be3.exe	64
PID 348 wrote to memory of 2488	348	0083cdba3deee931b709d91c77561be3.exe	64
PID 348 wrote to memory of 2488	348	0083cdba3deee931b709d91c77561be3.exe	64

C:\Users\Admin\AppData\Local\Temp\0083cdba3deee931b709d91c77561be3.exe
"C:\Users\Admin\AppData\Local\Temp\0083cdba3deee931b709d91c77561be3.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:348
- C:\Program Files (x86)\nsbi\jnapz.exe
  "C:\Program Files (x86)\nsbi\jnapz.exe"
  2⤵
  - Executes dropped EXE
  PID:2488

memory/348-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/348-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/348-6-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2488-8-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2488-7-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download