2791f109f38b78027d4da9c003e109a0b8d50f826c839b9810af826f5af30513

Analysis

max time kernel
69s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 01:55

Target

0ad18396d13bb6fd0d4b36c2998b5e2d.exe
Size

60KB
MD5

0ad18396d13bb6fd0d4b36c2998b5e2d
SHA1

c5aaa26178c1567c801519aa89fa28dffc0a4710
SHA256

2791f109f38b78027d4da9c003e109a0b8d50f826c839b9810af826f5af30513
SHA512

cf0e752fac341a294ba0b0e677c6e788229a9fc86a6c185a7cb55eaaebf4725dd18d69b2edd6c50f7b9bd13ffa4702616ecbd89d3cc4a45a896f1e607ee52cc5
SSDEEP

768:CQMwdh60kcm8txtO9qFLIUJH/cIJ93/knEOqtHW6Z69F2O220z:CQVkc1rVzfoEOqZZ6iO220z

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4048	pmdytops.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3108	0ad18396d13bb6fd0d4b36c2998b5e2d.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3108 wrote to memory of 4048	3108	0ad18396d13bb6fd0d4b36c2998b5e2d.exe	106
PID 3108 wrote to memory of 4048	3108	0ad18396d13bb6fd0d4b36c2998b5e2d.exe	106
PID 3108 wrote to memory of 4048	3108	0ad18396d13bb6fd0d4b36c2998b5e2d.exe	106
PID 3108 wrote to memory of 2148	3108	0ad18396d13bb6fd0d4b36c2998b5e2d.exe	104
PID 3108 wrote to memory of 2148	3108	0ad18396d13bb6fd0d4b36c2998b5e2d.exe	104
PID 3108 wrote to memory of 2148	3108	0ad18396d13bb6fd0d4b36c2998b5e2d.exe	104

C:\Users\Admin\AppData\Local\Temp\0ad18396d13bb6fd0d4b36c2998b5e2d.exe
"C:\Users\Admin\AppData\Local\Temp\0ad18396d13bb6fd0d4b36c2998b5e2d.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Windows\SysWOW64\cmd.exe
  /c del /f C:\Users\Admin\AppData\Local\Temp\0AD183~1.EXE.bak >> NUL
  2⤵
  PID:2148
- C:\ProgramData\tinepmvu\pmdytops.exe
  C:\ProgramData\tinepmvu\pmdytops.exe
  2⤵
  - Executes dropped EXE
  PID:4048