b14a3cd95baf4b4a1deb8d29342831e8000493f7acb2750faf72e0fd314772d7

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 04:22

Target

toolsbox-v18.exe
Size

8.2MB
MD5

616b5ca5dac5f19f82374d6fc255ac7c
SHA1

4d5f23bfd2f2f4f3f14e490e7c282355ee49dcbe
SHA256

1be40f1b610ff4e4c46f0f378435d4735bf97ae2f29874ad4faafa4e892b088a
SHA512

716874a618061a84a339ad54e3ba30bb10c323f2bfab3de09df3fe79637537a6089fe1dc5479e7cf906b972c8c3496894bdb2770ea605e7d4bcd22b2182fd00f
SSDEEP

196608:VFEZhR/MRkw+V3SJybsNLat3geDg9EblM54CEstZ3P4rpT:VuBsNz9QlM6vAFOR

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4092	toolsbox-v18.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 692 wrote to memory of 4092	692	toolsbox-v18.exe	24
PID 692 wrote to memory of 4092	692	toolsbox-v18.exe	24
PID 692 wrote to memory of 4092	692	toolsbox-v18.exe	24

C:\Users\Admin\AppData\Local\Temp\toolsbox-v18.exe
"C:\Users\Admin\AppData\Local\Temp\toolsbox-v18.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:692
- C:\Users\Admin\AppData\Local\Temp\is-39GT2.tmp\toolsbox-v18.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-39GT2.tmp\toolsbox-v18.tmp" /SL5="$40218,8359225,52224,C:\Users\Admin\AppData\Local\Temp\toolsbox-v18.exe"
  2⤵
  - Executes dropped EXE
  PID:4092

C:\Users\Admin\AppData\Local\Temp\is-39GT2.tmp\toolsbox-v18.tmp

Filesize
121KB

MD5
720f5b6775180c6cbac061f70fd0944b

SHA1
4263be10509e5e762d7bc8f035fa1c05b31f86e6

SHA256
b964ec18f0051e2dd8bd94cc87dda0e35ec19551d278af3556f8b5aa59091adb

SHA512
6a7d2121412e075ad2373097e21fd1beffd5900c96503edf941fb34e4daa864a00f91643421a1d6f2a4f9f45432a9bc08a6b8db878e13ec3d7c5fea6f06a142a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-39GT2.tmp\toolsbox-v18.tmp

Filesize
60KB

MD5
b22c90a320f1a4e6db39f9d1937c50f7

SHA1
055d662612b1b64eb8b8aeee0f1d56d180821641

SHA256
1a07cbe18083095d13434104b91a46812ae7e86e6bc85a7b3ea265ee4e3451d4

SHA512
d37384565ca2c3c911d0650e709e1e11b3e6efe4abcb8d1d6a17269394d95af9a22c114487d6c595b667f5cc898d28735e00c31be4c030078f2e996b68e3c226

Download Submit
memory/692-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/692-2-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/692-13-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4092-7-0x0000000002220000-0x0000000002221000-memory.dmp

Filesize
4KB

Download
memory/4092-14-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/4092-17-0x0000000002220000-0x0000000002221000-memory.dmp

Filesize
4KB

Download