4f5e9adab812625d49dcb7bdc907ee19103316451f5ab5fd3039e08e751204dd

Analysis

max time kernel
136s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/01/2024, 16:16

Target

592a8d494d1ea06e199846eddfcb46df.exe
Size

1.9MB
MD5

592a8d494d1ea06e199846eddfcb46df
SHA1

068ae60fd0d23cc2cfa6b16bb41ccb307ad87bc9
SHA256

4f5e9adab812625d49dcb7bdc907ee19103316451f5ab5fd3039e08e751204dd
SHA512

d22cf5afb95db8280e97649a8fe12d0ea3b7a048d23f270f7e9141a395f9e15df88544c87e14109420d6c99282bd7b48835b71df8c7b86189df8df161e633721
SSDEEP

49152:Qoa1taC070dN6cmzXCBXjucAvRp/YUXzfne/AezlbfprPR:Qoa1taC0yGccjiAezlBPR

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2968	4F1A.tmp

Executes dropped EXE 1 IoCs

pid	Process
2968	4F1A.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 2968	4920	592a8d494d1ea06e199846eddfcb46df.exe	92
PID 4920 wrote to memory of 2968	4920	592a8d494d1ea06e199846eddfcb46df.exe	92
PID 4920 wrote to memory of 2968	4920	592a8d494d1ea06e199846eddfcb46df.exe	92

C:\Users\Admin\AppData\Local\Temp\592a8d494d1ea06e199846eddfcb46df.exe
"C:\Users\Admin\AppData\Local\Temp\592a8d494d1ea06e199846eddfcb46df.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Users\Admin\AppData\Local\Temp\4F1A.tmp
  "C:\Users\Admin\AppData\Local\Temp\4F1A.tmp" --splashC:\Users\Admin\AppData\Local\Temp\592a8d494d1ea06e199846eddfcb46df.exe 5A1DAF40287B5EF53E7FF8444BE54FABE9E30284DDC21DA3A25F8F24E1290EDC0C327C25C593BEF12E6D27D3BC344C386E29ADFF6D739B5103E2C9229D16B850
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2968

C:\Users\Admin\AppData\Local\Temp\4F1A.tmp

Filesize
1.9MB

MD5
da36f129c7a8cc0d4fdc73a520227345

SHA1
a3f7152b1ac6e27c3f6dda530098156ea1a16db0

SHA256
3cfd4903fbced20d5beb180bcca90a3ec5b68d1fa23e0aaa27725d6252e21b6a

SHA512
c2a1ad59d074bdcb544c3f1c17898a45c831e0f7bd49fe8a89680029b3d78a401596b5f0046502f8d42125267ca632f95d632a16907f98ddca01e92e18205a2d

Download Submit
memory/2968-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4920-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download