6d9e6f653730f311dc0252a58690df1b83642fb567bc3eb35f502bbbf83b42a0

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 01:00

Target
4a3c04d4f0550a4aa717a0264bba8a44.exe
Size 209KB
Sample240108-bc3kaaaec9
SHA256 6d9e6f653730f311dc0252a58690df1b83642fb567bc3eb35f502bbbf83b42a0
MD5 4a3c04d4f0550a4aa717a0264bba8a44
SHA1 783df52b3231ecd9f6a087459e69c9cda08a0bb8
SHA512 f935cabf9cdcb6c6eba6182763f6fd0482caf37846709aaecfa8c01973b6c1335788878c9f90c14e8479e6526f29d9ebb2712f5628e6328a2768416e756d5b4b
SSDEEP 3072:Gl7B6Ft6+DKlQCrqAP7+ljhpsPhahBwfEC5bZvNi7T9Dqun6vl/AdIF5EqEK+Sgw:Gl7uut7agYr0JNi7B5IlWedEK+9Anj
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 2 IoCs

pid	Process
3716	u.dll
396	mpress.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 532	3216	4a3c04d4f0550a4aa717a0264bba8a44.exe	24
PID 3216 wrote to memory of 532	3216	4a3c04d4f0550a4aa717a0264bba8a44.exe	24
PID 3216 wrote to memory of 532	3216	4a3c04d4f0550a4aa717a0264bba8a44.exe	24
PID 532 wrote to memory of 3716	532	cmd.exe	23
PID 532 wrote to memory of 3716	532	cmd.exe	23
PID 532 wrote to memory of 3716	532	cmd.exe	23
PID 3716 wrote to memory of 396	3716	u.dll	21
PID 3716 wrote to memory of 396	3716	u.dll	21
PID 3716 wrote to memory of 396	3716	u.dll	21

C:\Users\Admin\AppData\Local\Temp\4a3c04d4f0550a4aa717a0264bba8a44.exe
"C:\Users\Admin\AppData\Local\Temp\4a3c04d4f0550a4aa717a0264bba8a44.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\474A.tmp\vir.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:532

C:\Users\Admin\AppData\Local\Temp\47A8.tmp\mpress.exe
"C:\Users\Admin\AppData\Local\Temp\47A8.tmp\mpress.exe" "C:\Users\Admin\AppData\Local\Temp\exe47A9.tmp"
1⤵
- Executes dropped EXE
PID:396

memory/396-55-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/396-63-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3216-0-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/3216-1-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/3216-71-0x0000000000400000-0x00000000004BF000-memory.dmp

Download