f5cd8916bb175a6eda556757ff61fc1dbaaae4bea5956dece0301e36209c134f

Analysis

max time kernel
141s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 04:05

Target

0ddad5537e998ca95148213f44f33b01.exe
Size

1.9MB
MD5

0ddad5537e998ca95148213f44f33b01
SHA1

74a10242f1d73446c4a8b837db00785837b2c0d0
SHA256

f5cd8916bb175a6eda556757ff61fc1dbaaae4bea5956dece0301e36209c134f
SHA512

70d408d5d83d769c1469cc57ccc7a3ecb9a4475fe5d15834c1ee9ffcfaa20ed9fbbdd7292293e3a7796bb551ad19bc56203b93ba0f292763fc0c8eb7c9d69743
SSDEEP

49152:5abRL+SFAxoF/EUYI8BxR+8Skix0kinXBgJ:QbZ+QAxoFMhIgElkOKRgJ

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1532	0ddad5537e998ca95148213f44f33b01.tmp

Loads dropped DLL 1 IoCs

pid	Process
1532	0ddad5537e998ca95148213f44f33b01.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 1532	1628	0ddad5537e998ca95148213f44f33b01.exe	18
PID 1628 wrote to memory of 1532	1628	0ddad5537e998ca95148213f44f33b01.exe	18
PID 1628 wrote to memory of 1532	1628	0ddad5537e998ca95148213f44f33b01.exe	18

C:\Users\Admin\AppData\Local\Temp\0ddad5537e998ca95148213f44f33b01.exe
"C:\Users\Admin\AppData\Local\Temp\0ddad5537e998ca95148213f44f33b01.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Users\Admin\AppData\Local\Temp\is-8FQ53.tmp\0ddad5537e998ca95148213f44f33b01.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-8FQ53.tmp\0ddad5537e998ca95148213f44f33b01.tmp" /SL5="$40222,1549099,54272,C:\Users\Admin\AppData\Local\Temp\0ddad5537e998ca95148213f44f33b01.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1532

memory/1532-7-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1532-35-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/1532-38-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1628-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1628-2-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1628-34-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download