850e3c2a050b7bf6ca6f2e5a0ebde92e8665f370c25aa5da902803dd502d21fc

Analysis

max time kernel
180s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 06:18

Target

2b78b6e57deac7ab08573bb6640bc83a.exe
Size

1.9MB
MD5

2b78b6e57deac7ab08573bb6640bc83a
SHA1

7ead000ad0fb648b02ea98323ab70a5501170dd0
SHA256

850e3c2a050b7bf6ca6f2e5a0ebde92e8665f370c25aa5da902803dd502d21fc
SHA512

ab700b6e06831dee92c52a33b29f3db7efbee5237315a612213fdbf79479c129d3438dcea2c2bc7c1d8dfae4dcca90c94c23cedb24cf7068eebb9afa6a944fca
SSDEEP

49152:Qoa1taC070d5H2D0RCYtGjgZDVjP4iwyySp6S:Qoa1taC0GHaw7agZRjfySp6S

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3612	1400.tmp

Executes dropped EXE 1 IoCs

pid	Process
3612	1400.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 3612	2640	2b78b6e57deac7ab08573bb6640bc83a.exe	88
PID 2640 wrote to memory of 3612	2640	2b78b6e57deac7ab08573bb6640bc83a.exe	88
PID 2640 wrote to memory of 3612	2640	2b78b6e57deac7ab08573bb6640bc83a.exe	88

C:\Users\Admin\AppData\Local\Temp\2b78b6e57deac7ab08573bb6640bc83a.exe
"C:\Users\Admin\AppData\Local\Temp\2b78b6e57deac7ab08573bb6640bc83a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Users\Admin\AppData\Local\Temp\1400.tmp
  "C:\Users\Admin\AppData\Local\Temp\1400.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2b78b6e57deac7ab08573bb6640bc83a.exe 71427CD2CA1DA3AB8659D67D6A75739D59174B0CFF3267CC6B1799113E4EF72A813AB80EA748994EDEE8F4192C510E389D44CC1130C72948386FBCE4FB72F0A4
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3612

C:\Users\Admin\AppData\Local\Temp\1400.tmp

Filesize
1.7MB

MD5
02f7348d25d636c9b7edb6b3e8759d4a

SHA1
8e2ac291c2014f84e07dab8eb8b0edd4ab1670d2

SHA256
c7d604b1aff587486636edac7a46b092256bef29883b5bd04123a66ba1045085

SHA512
7c8bcb839778b4d6c0c55e37aa3cdd5c02ea981683924f21a19d90eba5049ccbc7e000da79eccce67388ab19eea1b634b88eae87a710507887bb7dd1b9b8027d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1400.tmp

Filesize
1.4MB

MD5
85d43a7441a9e0b3ecfb480cf2111321

SHA1
62a37b042a4580a96388f46a7a791f91c6fc457f

SHA256
70806041700ed5c47f57270d9303a213c23eda0146bbcaa9d5fecda8874d332c

SHA512
39c03bda3bdd0de929331e6a997b15e3142cc05deea1be8d153a8ff1c1af40a633171a0f79235ff11763e145c21591fe437c9a4a398f3c02225dee7ffc8e86d9

Download Submit
memory/2640-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/3612-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download