3521dbbffa31d793a7ef1cd30a03b1b7397a218a90286bb45102fb939b1f6b6d

Analysis

max time kernel
142s
max time network
6s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
02/01/2024, 15:08

Target

3dc8912571ea7ae14465da8f884fa39d.exe
Size

8.8MB
MD5

3dc8912571ea7ae14465da8f884fa39d
SHA1

9046ab76266d34fe6efd026d89be4d13108f3742
SHA256

3521dbbffa31d793a7ef1cd30a03b1b7397a218a90286bb45102fb939b1f6b6d
SHA512

9e3ab0776806ec09c1fd434dda75f8d15fdc0f6123efa90c4058e5262c25033c0da9a692d4566e9caabc198c3714ecc6c606b4423ce5a4eb6cdc02ff09f850a5
SSDEEP

196608:02rPQPYw/CsXDjDyfuL2WliXYrHW1LJMcnESQ9ICmiwm6DP:j8P3CEDhL2ciIrHWRurzICmJ

Score

7^/10

Loads dropped DLL 28 IoCs

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 2104	1364	3dc8912571ea7ae14465da8f884fa39d.exe	23
PID 1364 wrote to memory of 2104	1364	3dc8912571ea7ae14465da8f884fa39d.exe	23

C:\Users\Admin\AppData\Local\Temp\3dc8912571ea7ae14465da8f884fa39d.exe
"C:\Users\Admin\AppData\Local\Temp\3dc8912571ea7ae14465da8f884fa39d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Users\Admin\AppData\Local\Temp\3dc8912571ea7ae14465da8f884fa39d.exe
  "C:\Users\Admin\AppData\Local\Temp\3dc8912571ea7ae14465da8f884fa39d.exe"
  2⤵
  - Loads dropped DLL
  PID:2104