195a108df7e3f6199a97af0b17514a0e16e9d982d217a672e541b12576a74d51

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 18:19

Target

572a4b5280b7872e27c4ab77a4ec7670.exe
Size

1.9MB
MD5

572a4b5280b7872e27c4ab77a4ec7670
SHA1

17e3c2a4cb2edb5839e9e1f49b98cda5a326a25d
SHA256

195a108df7e3f6199a97af0b17514a0e16e9d982d217a672e541b12576a74d51
SHA512

8ae15fd645b304029893a5aba0efcf503363ebfa987b04a40b78d559ac59d847f339d23537b23a8250af0aa505dd8a968de4ccbcffe4ceca0e381a5df10c5ab4
SSDEEP

49152:Qoa1taC070dnnrzpstjrQZSIdOFYk7W9YhTVL5n:Qoa1taC0krzWjrQbOqz9KZ

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3704	4892.tmp

Executes dropped EXE 1 IoCs

pid	Process
3704	4892.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 264 wrote to memory of 3704	264	572a4b5280b7872e27c4ab77a4ec7670.exe	91
PID 264 wrote to memory of 3704	264	572a4b5280b7872e27c4ab77a4ec7670.exe	91
PID 264 wrote to memory of 3704	264	572a4b5280b7872e27c4ab77a4ec7670.exe	91

C:\Users\Admin\AppData\Local\Temp\572a4b5280b7872e27c4ab77a4ec7670.exe
"C:\Users\Admin\AppData\Local\Temp\572a4b5280b7872e27c4ab77a4ec7670.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:264
- C:\Users\Admin\AppData\Local\Temp\4892.tmp
  "C:\Users\Admin\AppData\Local\Temp\4892.tmp" --splashC:\Users\Admin\AppData\Local\Temp\572a4b5280b7872e27c4ab77a4ec7670.exe 734C2F43C6171BA96B8D4967730A742B6AF21D27859BDF09A8FB4D5772AAE399BA1E2E65C5BA2492A6FB157FAB80CC4685FF8C28DAF2B02AFF2F80A21B211D57
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3704

C:\Users\Admin\AppData\Local\Temp\4892.tmp

Filesize
590KB

MD5
b82c8c4750bc69a0df575d97a15a8751

SHA1
b2d03be4762a7e3da975d3df15a7d53818137930

SHA256
1cc295a9693823339f8cacd21ef71bb2da8b7e763c15ec654d3d462d66bcdca7

SHA512
49c4b35964fe0f3e6432a4bef7af9f73f2d6b5da684ab2fe8d0879142b30d87a1e14ec8ade13078c3470d4648272a2cb70e96f6efb17b33cacda4fbe0f719e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\4892.tmp

Filesize
751KB

MD5
7febce80685f6d84f596f87ed9500b5f

SHA1
9580b81dc75995727d2055b59dea037b387cbf98

SHA256
25009f9c29377a5d5bf8ca5b49f8fb81f29cde8dbed3b8b45042e7958e964b2c

SHA512
e4e8513fda64a402735ba7507586c57c0b706ae9073bf1aff5de90e63b49c2af6e358883403fb6527559a84ea366b9e3256b309b21792a2765e419768cb8ba1e

Download Submit
memory/264-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/3704-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download