96ff6650e3a460f142977e02979b0402b65623d89c6b65383ff739712233be96

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2024, 01:01

Target

521eb8675a2b7e0c8872a0a71e9651cf.exe
Size

1.9MB
MD5

521eb8675a2b7e0c8872a0a71e9651cf
SHA1

bc2dc6ebc59b76299fbf8bcc20226a7451ae813d
SHA256

96ff6650e3a460f142977e02979b0402b65623d89c6b65383ff739712233be96
SHA512

9a814e4cc75c8df243995c036df3d36f34fe05699ddb472392c9fdc2074fbcb4bda0f9ad7df2430c5d399746a4dc6f379a3dafdd780ba80b01afbcb79b12f633
SSDEEP

49152:Qoa1taC070drLCfyGO0koVI7JkFsCnP+44fMu:Qoa1taC0ML68KykOCnW440u

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3484	4FC6.tmp

Executes dropped EXE 1 IoCs

pid	Process
3484	4FC6.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 3484	772	521eb8675a2b7e0c8872a0a71e9651cf.exe	90
PID 772 wrote to memory of 3484	772	521eb8675a2b7e0c8872a0a71e9651cf.exe	90
PID 772 wrote to memory of 3484	772	521eb8675a2b7e0c8872a0a71e9651cf.exe	90

C:\Users\Admin\AppData\Local\Temp\521eb8675a2b7e0c8872a0a71e9651cf.exe
"C:\Users\Admin\AppData\Local\Temp\521eb8675a2b7e0c8872a0a71e9651cf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:772
- C:\Users\Admin\AppData\Local\Temp\4FC6.tmp
  "C:\Users\Admin\AppData\Local\Temp\4FC6.tmp" --splashC:\Users\Admin\AppData\Local\Temp\521eb8675a2b7e0c8872a0a71e9651cf.exe 6E76959B247B42DFB25B306A7CE86A6BD785FB354D9E1941A4B955291CB25E002EBB5395738609421CD16348E54A8401F4410367051DCA782FE7E470F878791B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3484

C:\Users\Admin\AppData\Local\Temp\4FC6.tmp

Filesize
1.4MB

MD5
3b30d3884e88e31913f931854c19b08b

SHA1
eaca6e3bd9f328e63dc96e3fe6177b0328241014

SHA256
c11561ddd3c790f61eeb3ff46d871e21c878520741d1926ee35388092844b518

SHA512
4a12f6810e4d91b3d925eac195719ad1f8cd84129c1a0fdea79d47b5d8434b3f961303f719a74b867e3c6c27e473991bcf86716b3de5f3ab35f64f8bf4b3352a

Download Submit
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp

Filesize
891KB

MD5
bc7df6007ec223fad597ee0849208a72

SHA1
ec4b1aa47efff211a170fb332f309571a8b9fd2b

SHA256
4a46a7417b18800179692dcfc9f46deb6063a31767f1f61a87cf48f537264ba2

SHA512
0a795c5876699203f59c8e18b9e0c3fc3b8fb74cfe96135c4e93b70c30a1bd27da8a3f462c56153bffccb18673b06024f72afb313f607e474e39ae7c86cdca2c

Download Submit
memory/772-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/3484-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download