4ec0207f077e26044e8069cebb96334ab07359886698a696dc14dd3333eaeec1

Analysis

max time kernel
192s
max time network
224s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2024, 17:29

Target
417b05e5b5977bdeb35b719cb766f4d4.exe
Size 1.9MB
Sample240104-v2n8qsgdf2
SHA256 4ec0207f077e26044e8069cebb96334ab07359886698a696dc14dd3333eaeec1
MD5 417b05e5b5977bdeb35b719cb766f4d4
SHA1 eb877e0c001e56bfe76e54d3960946a6618363db
SHA512 343603bddf772916792587651102ad92c4e7bffb98b3c425426ef57a41aede93c6141b4e716973348930a9e0a9885d4a8752c9390f78486102e6a7d4adc889bc
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dwAIqN8zgphWdfU2BoT2NEtELT4akP2JjueY8:Qoa1taC070dZBWJzOT2NE+UqjueSi3
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4192	BFFF.tmp

Executes dropped EXE 1 IoCs

pid	Process
4192	BFFF.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 4192	4776	417b05e5b5977bdeb35b719cb766f4d4.exe	93
PID 4776 wrote to memory of 4192	4776	417b05e5b5977bdeb35b719cb766f4d4.exe	93
PID 4776 wrote to memory of 4192	4776	417b05e5b5977bdeb35b719cb766f4d4.exe	93

C:\Users\Admin\AppData\Local\Temp\417b05e5b5977bdeb35b719cb766f4d4.exe
"C:\Users\Admin\AppData\Local\Temp\417b05e5b5977bdeb35b719cb766f4d4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Users\Admin\AppData\Local\Temp\BFFF.tmp
  "C:\Users\Admin\AppData\Local\Temp\BFFF.tmp" --splashC:\Users\Admin\AppData\Local\Temp\417b05e5b5977bdeb35b719cb766f4d4.exe D1B40177164396422A4A1EA13B54B3190DCA79DE54A39913F59CA4C6BADDE0C5B7D6FD3E89C76B452610920127A2EFF09710D13B76F6EB99F601446B1434A09C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4192

BFFF.tmp

Path C:\Users\Admin\AppData\Local\Temp\BFFF.tmp
Size 1.0MB
SHA256 5f19f94bba7421b811acbf23af4def75c09a9599fe19abd53f596ee38aec0e1d
MD5 080c35e9eeb3de40c2d6a390862e7918
SHA1 f1982a59f0b3046fdc3980ad815920a5c0e3d735
SHA512 a28561e311f4ddb896ba3f8f6fc9ef3309ea3425e72e84f0f41c5905e61f30b9354eb9e548e3d15478025842204579690d07d817ecf4d474e40d367df2d575ef
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10d9rrd7h9u93G3u:Qoa1taC070dddO93Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

BFFF.tmp

Path C:\Users\Admin\AppData\Local\Temp\BFFF.tmp
Size 1.9MB
SHA256 dc2a3327ea47a6525eda84777d5300b16d9b3b33d5ea1fa2fe68e22edd444ae0
MD5 6002d4d2de94970643133dc823d99d5a
SHA1 7c30a50de60e347d539b8a60ce0e29199e341625
SHA512 675c9574c1daa082a1e66de8b9b589e25ce67c4d9971ec4b5b6aadad4ba91de986f9afbcb14ce5dbe695ab014e38a2f3270203e1772ea9aa6061c34d6f1f3f6b
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10d9rrd7h9u93G35iLr0uOhY4333E/JsqCkeMCR:Qoa1taC070dddO93rtOGZGMCSI
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4192-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4776-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download