499aedc02c1f6fe422cebd2c513346c1d5d474f8b33f121b0e1332f44cd2d2e8

Analysis

max time kernel
144s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 16:33

Target

51106a564002320f30435aa6c25b8dd3.exe
Size

2.0MB
MD5

51106a564002320f30435aa6c25b8dd3
SHA1

4304b24f723fbfafbcffa96cc7a5cfea7525ad06
SHA256

499aedc02c1f6fe422cebd2c513346c1d5d474f8b33f121b0e1332f44cd2d2e8
SHA512

8a6462a0a8c229ad5161a274988b0e159ea7698e631f5f37b6e76610463cc446249b6c20b42e57ddc014a1d2eb900d52cbae0574029b433f0029dec9a58b0400
SSDEEP

24576:dgdhhQGGnnazLpj4VHogiuGYNycAavew3mwmI1nk30sKbcGOyRWEMVM8w8sm/FvN:dqgazxcGYN139lnk30raxpX

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1092	mt.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\jgfn\mt.exe	51106a564002320f30435aa6c25b8dd3.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 1092	2124	51106a564002320f30435aa6c25b8dd3.exe	90
PID 2124 wrote to memory of 1092	2124	51106a564002320f30435aa6c25b8dd3.exe	90
PID 2124 wrote to memory of 1092	2124	51106a564002320f30435aa6c25b8dd3.exe	90

C:\Users\Admin\AppData\Local\Temp\51106a564002320f30435aa6c25b8dd3.exe
"C:\Users\Admin\AppData\Local\Temp\51106a564002320f30435aa6c25b8dd3.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Program Files (x86)\jgfn\mt.exe
  "C:\Program Files (x86)\jgfn\mt.exe"
  2⤵
  - Executes dropped EXE
  PID:1092

C:\Program Files (x86)\jgfn\mt.exe

Filesize
1008KB

MD5
804d90b5be927e1ab37933cec1ae4a7f

SHA1
7b8f80d4b23053d8c54297796d9ce95d5d45140b

SHA256
9f3420a46f245235f8e8751ceaa00c4c66285b9749effb6343b96af61d9fd61b

SHA512
66a4fbf7235442b1cb8d40fd7bd36de8e06b7a519ef12ccfb7173fdb8dedb10d0024ba43b35b1f3ad95f8ab6efc7f68a3bfc8c50ac61c067939d578822dca1c9

Download Submit
C:\Program Files (x86)\jgfn\mt.exe

Filesize
906KB

MD5
fba695122543cb97def5d189703e578d

SHA1
b7f346f4193ad0db1cc7135cba1167af87697686

SHA256
abd2e242dda6b560ee94d53efc66fc8a529d333ab0a4f282d7fa0a23b9ce4363

SHA512
6151fc7042b4a1b4b882610ecddb5c10ccbe8775c483ec343b0619dabcc43c2484a5b2238e06e66b0524ee633a1c1a760e39185905d2cf8976b14577f7ec5bf3

Download Submit
memory/1092-4-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2124-5-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download