30264c779cab6232419dea34d694e88a4f33faff4b8f370a6fbcb4f358a1333b

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
05/01/2024, 03:19

Target

429fa7f28111e3b8ad7c5f714a0ba514.exe
Size

1.9MB
MD5

429fa7f28111e3b8ad7c5f714a0ba514
SHA1

ffe22983b0170bd13ed03f0e555f4b61746c6036
SHA256

30264c779cab6232419dea34d694e88a4f33faff4b8f370a6fbcb4f358a1333b
SHA512

c3b6c63cc09df06e74598206b582b9d712d6213de81da2e3cea7ed363e9498c6f2195fc29912fa53cdf9d06bf1220cc004eff2736dbdb4c4d295b53d6884e8fd
SSDEEP

49152:Qoa1taC070dFhdQbYAR/O9yreR/z2ujGlM5:Qoa1taC0qgYARW9yr250w

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3756	D801.tmp

Executes dropped EXE 1 IoCs

pid	Process
3756	D801.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 3756	2656	429fa7f28111e3b8ad7c5f714a0ba514.exe	92
PID 2656 wrote to memory of 3756	2656	429fa7f28111e3b8ad7c5f714a0ba514.exe	92
PID 2656 wrote to memory of 3756	2656	429fa7f28111e3b8ad7c5f714a0ba514.exe	92

C:\Users\Admin\AppData\Local\Temp\429fa7f28111e3b8ad7c5f714a0ba514.exe
"C:\Users\Admin\AppData\Local\Temp\429fa7f28111e3b8ad7c5f714a0ba514.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Users\Admin\AppData\Local\Temp\D801.tmp
  "C:\Users\Admin\AppData\Local\Temp\D801.tmp" --splashC:\Users\Admin\AppData\Local\Temp\429fa7f28111e3b8ad7c5f714a0ba514.exe 90D3026E3A330022FA99F19A10FF9BDC1EDE56C50A7B9B9DA427367A6AF8A3DD4E86085AAAFA89949ABCE6137718CB0F4A565181DFE49D6FB73F9BCBE3B266B8
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3756

C:\Users\Admin\AppData\Local\Temp\D801.tmp

Filesize
1.9MB

MD5
99fc46eaada63644d924fa2f94952064

SHA1
4ef606ec654f2c176fa8362b3df43f74dc868b3b

SHA256
59b3a727574a43e0432649e2c12ab2768a610d95cfc86a9d9688671ba076906d

SHA512
85ac0dfa3e138833579519e3984c0d6ec24d9c234a5be97f70344f8b99caa3cdeeaedb0914a7f14954a2e3bba94b5964f122bedc1a21e37d5f376b4afb1dbdc5

Download Submit
memory/2656-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/3756-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download