d9633d51f27da2a6e31fab3bce8ea26dd4b3fd5b5e42fbb43c46ad092aa51772

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/01/2024, 01:27

Target

bd8646691e2eb4e3467861fc765cfc3a45925243afac513944a922a1100d80bb.exe
Size

238KB
MD5

4e28b8c8cc2666b35c7a3c2ca03946e1
SHA1

784e1beca241a4cac7ad270e549c28da2f5f7e07
SHA256

bd8646691e2eb4e3467861fc765cfc3a45925243afac513944a922a1100d80bb
SHA512

5c8a938ef1b11bd3b016bb4f63d8b154b6de6f8947b90f520474257ff3bb583a7a13dbb0f83f90ea101bb5fa88febc18b28bffa3133d3f5b76ec656702834954
SSDEEP

6144:1/mi5BPc1M3xwunB4qELod1EREYuPdX6/V:1JxwunB4qEU3fYzN

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4560	pro.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	19	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	37	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 4560	4320	bd8646691e2eb4e3467861fc765cfc3a45925243afac513944a922a1100d80bb.exe	95
PID 4320 wrote to memory of 4560	4320	bd8646691e2eb4e3467861fc765cfc3a45925243afac513944a922a1100d80bb.exe	95
PID 4320 wrote to memory of 4560	4320	bd8646691e2eb4e3467861fc765cfc3a45925243afac513944a922a1100d80bb.exe	95

C:\Users\Admin\AppData\Local\Temp\bd8646691e2eb4e3467861fc765cfc3a45925243afac513944a922a1100d80bb.exe
"C:\Users\Admin\AppData\Local\Temp\bd8646691e2eb4e3467861fc765cfc3a45925243afac513944a922a1100d80bb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Users\Public\pro.exe
  "C:\Users\Public\pro.exe"
  2⤵
  - Executes dropped EXE
  PID:4560

C:\Users\Public\pro.exe

Filesize
238KB

MD5
4e28b8c8cc2666b35c7a3c2ca03946e1

SHA1
784e1beca241a4cac7ad270e549c28da2f5f7e07

SHA256
bd8646691e2eb4e3467861fc765cfc3a45925243afac513944a922a1100d80bb

SHA512
5c8a938ef1b11bd3b016bb4f63d8b154b6de6f8947b90f520474257ff3bb583a7a13dbb0f83f90ea101bb5fa88febc18b28bffa3133d3f5b76ec656702834954

Download Submit
memory/4320-0-0x0000000003EF0000-0x000000000407F000-memory.dmp

Filesize
1.6MB

Download
memory/4320-1-0x0000000010000000-0x0000000010192000-memory.dmp

Filesize
1.6MB

Download
memory/4320-7-0x0000000010000000-0x0000000010192000-memory.dmp

Filesize
1.6MB

Download
memory/4320-12-0x0000000010000000-0x0000000010192000-memory.dmp

Filesize
1.6MB

Download