d8eda9d1c0724fa9a1674e1cd0aba7854ac0151482b43fa522a2c541d483ac9f

Analysis

max time kernel
141s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 11:22

Target

565208bbe8aab8a2c3a1c1d53fd5ae51.exe
Size

1.9MB
MD5

565208bbe8aab8a2c3a1c1d53fd5ae51
SHA1

d21b92139993877e9c3e61002f40701e0d532ebc
SHA256

d8eda9d1c0724fa9a1674e1cd0aba7854ac0151482b43fa522a2c541d483ac9f
SHA512

81e3bed91318da8350374e1879adc495310567332828ebe4de0815b00333743abdf45dc0a61779efb9934c071181b8a82f0e0cb29fa4a97b1e3cebbe77647eca
SSDEEP

49152:Qoa1taC070dmBUMzn0WCCwinRYtVM3JJmCS:Qoa1taC0wU/nutV845

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4160	FAB.tmp

Executes dropped EXE 1 IoCs

pid	Process
4160	FAB.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 4160	2628	565208bbe8aab8a2c3a1c1d53fd5ae51.exe	89
PID 2628 wrote to memory of 4160	2628	565208bbe8aab8a2c3a1c1d53fd5ae51.exe	89
PID 2628 wrote to memory of 4160	2628	565208bbe8aab8a2c3a1c1d53fd5ae51.exe	89

C:\Users\Admin\AppData\Local\Temp\565208bbe8aab8a2c3a1c1d53fd5ae51.exe
"C:\Users\Admin\AppData\Local\Temp\565208bbe8aab8a2c3a1c1d53fd5ae51.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Users\Admin\AppData\Local\Temp\FAB.tmp
  "C:\Users\Admin\AppData\Local\Temp\FAB.tmp" --splashC:\Users\Admin\AppData\Local\Temp\565208bbe8aab8a2c3a1c1d53fd5ae51.exe 4BFD2A6B8D0C0B369FDE6EC59A1A73A8CFF63C4D8A86204604E4C80D5688664FE9454D189455A228A7E317E3FDFA797ECB9E4940E5EE4DC28D7270FBFDD13B2A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4160

C:\Users\Admin\AppData\Local\Temp\FAB.tmp

Filesize
1.9MB

MD5
6834ac27eea97d758bc325ed809d6eca

SHA1
ba6c0c25ec8e93f965099565e6a9c4f8b8845bc3

SHA256
44059fc7bfb0175f981f3060cc98e72384e7658be065177954cd9906e70e8876

SHA512
c7743f11b3c2dc46257231e59215ec38968ffce9924b9d0e9dac220b558512f42bcf47d67c23b699f6900b843fe5f00de97564189d29c1b753b980065d515c32

Download Submit
memory/2628-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4160-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download