23ff496319a696c1686450dc75276fbed2f80001c25be4a49b28cb0250f9c52f

Analysis

max time kernel
1s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10-01-2024 11:26

Target

506de9e518439c0120583e8598df0298.exe
Size

208KB
MD5

506de9e518439c0120583e8598df0298
SHA1

36206bc6ddde1a8931c8f8bab228ce9051b8ef90
SHA256

23ff496319a696c1686450dc75276fbed2f80001c25be4a49b28cb0250f9c52f
SHA512

34bf06e87c9806c8a80392439af00eb9090bfe1cd3024fb3b365f25bab3ec3bf362c653d68fc81315ded3e49ab3de0902f1b04cf8b0fb1550a8f53fa46866218
SSDEEP

6144:Cl2/rra+K+Unhhpir6snbxoCXkhVVE3WSVW:7o+UnDpir62ddXOj2e

Score

7^/10

Executes dropped EXE 2 IoCs

pid	Process
4408	u.dll
1860	mpress.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 3500	4532	506de9e518439c0120583e8598df0298.exe	25
PID 4532 wrote to memory of 3500	4532	506de9e518439c0120583e8598df0298.exe	25
PID 4532 wrote to memory of 3500	4532	506de9e518439c0120583e8598df0298.exe	25
PID 3500 wrote to memory of 4408	3500	cmd.exe	24
PID 3500 wrote to memory of 4408	3500	cmd.exe	24
PID 3500 wrote to memory of 4408	3500	cmd.exe	24
PID 4408 wrote to memory of 1860	4408	u.dll	20
PID 4408 wrote to memory of 1860	4408	u.dll	20
PID 4408 wrote to memory of 1860	4408	u.dll	20
PID 3500 wrote to memory of 3044	3500	cmd.exe	18
PID 3500 wrote to memory of 3044	3500	cmd.exe	18
PID 3500 wrote to memory of 3044	3500	cmd.exe	18

C:\Users\Admin\AppData\Local\Temp\506de9e518439c0120583e8598df0298.exe
"C:\Users\Admin\AppData\Local\Temp\506de9e518439c0120583e8598df0298.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\47E6.tmp\vir.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3500

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2312

C:\Users\Admin\AppData\Local\Temp\4844.tmp\mpress.exe
"C:\Users\Admin\AppData\Local\Temp\4844.tmp\mpress.exe" "C:\Users\Admin\AppData\Local\Temp\exe4845.tmp"
1⤵
- Executes dropped EXE
PID:1860

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1612

memory/1860-56-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1860-62-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4532-0-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/4532-1-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/4532-70-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download