85ffcdf2e89048bf83d8530c6edd152b759012c95481aee0f1b3bd3898a72a1e

Analysis

max time kernel
166s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 09:54

Target

5040a27a033e833cf463e6756c0c6134.exe
Size

108KB
MD5

5040a27a033e833cf463e6756c0c6134
SHA1

514c167b1d9ca81c1079ab64c27ba393cc808973
SHA256

85ffcdf2e89048bf83d8530c6edd152b759012c95481aee0f1b3bd3898a72a1e
SHA512

ddb26899f3995e83110b9afe08505e27ce22f2e428d9036e20c7e1f5ececa24dba2acbc9bace778c66b4982f281859ae66f3d8b94667018dba97fe9dbeaa1592
SSDEEP

1536:+RSO6MfF+9FXiZCar9FE9PWRKD+xuUMt+LB6FFkufly7GKK9Bv6dY:+M59FXice9ORWRxxY+LUoEly7GKK9IW

Score

1^/10

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\5040a27a033e833cf463e6756c0c6134.exe:Zone.Identifier	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 4460	2068	5040a27a033e833cf463e6756c0c6134.exe	105
PID 2068 wrote to memory of 4460	2068	5040a27a033e833cf463e6756c0c6134.exe	105

C:\Users\Admin\AppData\Local\Temp\5040a27a033e833cf463e6756c0c6134.exe
"C:\Users\Admin\AppData\Local\Temp\5040a27a033e833cf463e6756c0c6134.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\SYSTEM32\cmd.exe
  "cmd"
  2⤵
  - NTFS ADS
  PID:4460

memory/2068-0-0x00007FFC18C70000-0x00007FFC19611000-memory.dmp

Filesize
9.6MB

Download
memory/2068-1-0x00007FFC18C70000-0x00007FFC19611000-memory.dmp

Filesize
9.6MB

Download
memory/2068-2-0x0000000000F00000-0x0000000000F10000-memory.dmp

Filesize
64KB

Download
memory/2068-3-0x000000001B9C0000-0x000000001BE8E000-memory.dmp

Filesize
4.8MB

Download
memory/2068-4-0x00007FFC18C70000-0x00007FFC19611000-memory.dmp

Filesize
9.6MB

Download
memory/2068-5-0x00007FFC18C70000-0x00007FFC19611000-memory.dmp

Filesize
9.6MB

Download
memory/2068-6-0x000000001BE90000-0x000000001BF2C000-memory.dmp

Filesize
624KB

Download
memory/2068-7-0x0000000000A50000-0x0000000000A58000-memory.dmp

Filesize
32KB

Download
memory/2068-8-0x000000001D5B0000-0x000000001D656000-memory.dmp

Filesize
664KB

Download
memory/2068-9-0x0000000000F00000-0x0000000000F10000-memory.dmp

Filesize
64KB

Download
memory/2068-11-0x0000000000F00000-0x0000000000F10000-memory.dmp

Filesize
64KB

Download