af5b1bb90edfe3045a800ef6bb339b073d027511600a3520ae6e1d77244b2aeb

Analysis

max time kernel
106s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 00:43

Target

08e72d3d08e0696e46339f2a49521d85.exe
Size

1.9MB
MD5

08e72d3d08e0696e46339f2a49521d85
SHA1

d7e5a2524c860cbc64a391c324727e1f5841582b
SHA256

af5b1bb90edfe3045a800ef6bb339b073d027511600a3520ae6e1d77244b2aeb
SHA512

71af056d9a2bbc02de5397e6efa4cab895f3c9dd539243a1de010410f2f87024722f2a8adde0dae81e7eb9143f168bf42b602bb9cd9dc65657cade56d6c496bf
SSDEEP

49152:Qoa1taC070dlSsLR7lhh8whIQmA6x1Mv/:Qoa1taC0ZsLpb31mA6gv/

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4960	4C7A.tmp

Executes dropped EXE 1 IoCs

pid	Process
4960	4C7A.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 4960	5024	08e72d3d08e0696e46339f2a49521d85.exe	91
PID 5024 wrote to memory of 4960	5024	08e72d3d08e0696e46339f2a49521d85.exe	91
PID 5024 wrote to memory of 4960	5024	08e72d3d08e0696e46339f2a49521d85.exe	91

C:\Users\Admin\AppData\Local\Temp\08e72d3d08e0696e46339f2a49521d85.exe
"C:\Users\Admin\AppData\Local\Temp\08e72d3d08e0696e46339f2a49521d85.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Users\Admin\AppData\Local\Temp\4C7A.tmp
  "C:\Users\Admin\AppData\Local\Temp\4C7A.tmp" --splashC:\Users\Admin\AppData\Local\Temp\08e72d3d08e0696e46339f2a49521d85.exe 75A13D4540C60381720F98204DABD3651D41F53400939265C8B965510356C4966D3D5E2F6204830D1BEE9989D85BE172C6A8B5C1A63C25CFB9A4081425282A11
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4960

memory/4960-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/5024-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download