c55b692a2d41ac645a064d6d806f3dbda737ee6d483492635bab36baefd64ddb

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2024, 22:19

Target

54bc2e1ac1d8f88dbd5f5a52dd739a2d.exe
Size

1.1MB
MD5

54bc2e1ac1d8f88dbd5f5a52dd739a2d
SHA1

43542fa03a2d839084fb0f0e6fd44f63eb76e649
SHA256

c55b692a2d41ac645a064d6d806f3dbda737ee6d483492635bab36baefd64ddb
SHA512

1590a425249d8e9d29d941379a255193d38fc82b8ee5f01988630c89b54bf8f5d0a5e7b2031c13bb4edd1c6c2cdd648ba9ad5597c4db94980b78c9ba2baa40f6
SSDEEP

24576:SypW9SgLNZaOdcTMuUvxIgaADhJvawLsO9eR6GkeKx/mxbnAHdyZvLRG:St9SgLNZa6xINhwZAaeKx/ibnAevLg

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3824	4B41.tmp

Executes dropped EXE 1 IoCs

pid	Process
3824	4B41.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3160 wrote to memory of 3824	3160	54bc2e1ac1d8f88dbd5f5a52dd739a2d.exe	20
PID 3160 wrote to memory of 3824	3160	54bc2e1ac1d8f88dbd5f5a52dd739a2d.exe	20
PID 3160 wrote to memory of 3824	3160	54bc2e1ac1d8f88dbd5f5a52dd739a2d.exe	20

C:\Users\Admin\AppData\Local\Temp\54bc2e1ac1d8f88dbd5f5a52dd739a2d.exe
"C:\Users\Admin\AppData\Local\Temp\54bc2e1ac1d8f88dbd5f5a52dd739a2d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3160
- C:\Users\Admin\AppData\Local\Temp\4B41.tmp
  "C:\Users\Admin\AppData\Local\Temp\4B41.tmp" --pingC:\Users\Admin\AppData\Local\Temp\54bc2e1ac1d8f88dbd5f5a52dd739a2d.exe C750D8B31976CE18EDD0AE3B68DE50B3A9FE1E0C0409ED05FB721E21BDD8B5C55C42CA98762956DD0E9B3A5E1DE89C62968657B027BDFF67A0D6DB4F6E6022F7
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3824

C:\Users\Admin\AppData\Local\Temp\4B41.tmp

Filesize
1.1MB

MD5
c5d101914d8406c1ae5a8f8706fa6e1a

SHA1
bd314a08045bd078895f1d0b3380a0d563c39156

SHA256
aa3263acef91e3eaf163e4c82df550887538c499e1afa3362e5652fbe8fbd887

SHA512
f5b5675cfc8ab27d9124de162ec2c5dbaa6cb24270e8423c939a5f2ed65750a05d1547fca54cdfb1d0a41e92cb2954e2dca6a0bd294910abfb908e3053dcb314

Download Submit
memory/3160-2-0x0000000001290000-0x00000000012E0000-memory.dmp

Filesize
320KB

Download
memory/3160-0-0x0000000000A20000-0x0000000000B65000-memory.dmp

Filesize
1.3MB

Download
memory/3824-8-0x0000000000E90000-0x0000000000FD5000-memory.dmp

Filesize
1.3MB

Download
memory/3824-7-0x0000000001540000-0x0000000001590000-memory.dmp

Filesize
320KB

Download