23d0ec54bc45fde229f0435aeea2c75c4ecd92e3b174b5efd43d3f62749c8ba1

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 01:58

Target

0ae6a67be9ebfc240ddbfacfbed8fea7.exe
Size

1.5MB
MD5

0ae6a67be9ebfc240ddbfacfbed8fea7
SHA1

19dee10961a4669477892224d4a70f806876fcee
SHA256

23d0ec54bc45fde229f0435aeea2c75c4ecd92e3b174b5efd43d3f62749c8ba1
SHA512

de9c6184966c6162918cdae1792107dc9576b93975540dc00f113fb6324cfc472f85593d43d07b5b5ad8fdef420bd95fcb4c9d815e899c46bace544c84d3cd49
SSDEEP

24576:e9dG37Vk0R07Qanm9+XA9Jp8GnT26JSG5UEdPDeswt1T/LLTYwazt:lrq0R07QQmiA9cciG6E613VaZ

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1896	470B.tmp

Executes dropped EXE 1 IoCs

pid	Process
1896	470B.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 1896	4556	0ae6a67be9ebfc240ddbfacfbed8fea7.exe	21
PID 4556 wrote to memory of 1896	4556	0ae6a67be9ebfc240ddbfacfbed8fea7.exe	21
PID 4556 wrote to memory of 1896	4556	0ae6a67be9ebfc240ddbfacfbed8fea7.exe	21

C:\Users\Admin\AppData\Local\Temp\0ae6a67be9ebfc240ddbfacfbed8fea7.exe
"C:\Users\Admin\AppData\Local\Temp\0ae6a67be9ebfc240ddbfacfbed8fea7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Users\Admin\AppData\Local\Temp\470B.tmp
  "C:\Users\Admin\AppData\Local\Temp\470B.tmp" --pingC:\Users\Admin\AppData\Local\Temp\0ae6a67be9ebfc240ddbfacfbed8fea7.exe 9B66A0538E940D7D6DB2E9345D3E7E0D52A5E295CFE55E20D52C780C8D12A1A5BF36120FAD61B17CA8C629856000D2DD289A2E77A73F569CDD5F1CB7840BB91A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1896

C:\Users\Admin\AppData\Local\Temp\470B.tmp

Filesize
348KB

MD5
d59ce307cda575d977b434d5503f251e

SHA1
0f43f78a399b7be449816adba1940d74cd3dbdeb

SHA256
aa35f0df6a1a60e9683831096d146bbd1d5df78ee8b3fe6f4375276f444377c0

SHA512
979cd1b0061b5ad9673338ffb28d9c9b638c324113f163cb474af1fe5a6b274b39034eb9aa91daf5414a03da375c14d6c791cb2ec65d95895917d632a099929f

Download Submit
memory/1896-9-0x0000000002F50000-0x0000000002FCA000-memory.dmp

Filesize
488KB

Download
memory/1896-7-0x0000000000AA0000-0x0000000000C6E000-memory.dmp

Filesize
1.8MB

Download
memory/4556-2-0x00000000024B0000-0x000000000252A000-memory.dmp

Filesize
488KB

Download
memory/4556-0-0x0000000000190000-0x000000000035E000-memory.dmp

Filesize
1.8MB

Download