49181c6af264614d03875b8436783b6ed8a678052483afd8dab7c7d893656c56

Analysis

max time kernel
142s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2024, 04:26

Target

6477461fd7ddd48e195956d286f83ac1.exe
Size

744KB
MD5

6477461fd7ddd48e195956d286f83ac1
SHA1

c37e900f755cb81622168a7332406f1845c8be1d
SHA256

49181c6af264614d03875b8436783b6ed8a678052483afd8dab7c7d893656c56
SHA512

1f346bc25f2bdc681412dd3fd04333544629f7360593e3917d948369953e79977592f527ebd4a821f85a6a02b566a05d5fdbba14df6e4d702348cd5b2267d2c2
SSDEEP

12288:uaHc64b888888888888W888888888889jscV7TdjL47zdU5imqsX3sv33rD+zG/k:F86IIW7uvmQBsHUezG/aYFkJR30F6rpF

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4976	6477461fd7ddd48e195956d286f83ac1.tmp

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	8	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 4976	2172	6477461fd7ddd48e195956d286f83ac1.exe	86
PID 2172 wrote to memory of 4976	2172	6477461fd7ddd48e195956d286f83ac1.exe	86
PID 2172 wrote to memory of 4976	2172	6477461fd7ddd48e195956d286f83ac1.exe	86

C:\Users\Admin\AppData\Local\Temp\6477461fd7ddd48e195956d286f83ac1.exe
"C:\Users\Admin\AppData\Local\Temp\6477461fd7ddd48e195956d286f83ac1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Users\Admin\AppData\Local\Temp\is-RS70A.tmp\6477461fd7ddd48e195956d286f83ac1.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-RS70A.tmp\6477461fd7ddd48e195956d286f83ac1.tmp" /SL5="$A0048,371795,121344,C:\Users\Admin\AppData\Local\Temp\6477461fd7ddd48e195956d286f83ac1.exe"
  2⤵
  - Executes dropped EXE
  PID:4976

C:\Users\Admin\AppData\Local\Temp\is-RS70A.tmp\6477461fd7ddd48e195956d286f83ac1.tmp

Filesize
1.1MB

MD5
34acc2bdb45a9c436181426828c4cb49

SHA1
5adaa1ac822e6128b8d4b59a54d19901880452ae

SHA256
9c81817acd4982632d8c7f1df3898fca1477577738184265d735f49fc5480f07

SHA512
134ff4022571efd46f7a62e99b857ebe834e9916c786345908010f9e1fb90be226b740ddee16ae9290fe45c86be7238c4555e422abe66a461d11545e19734beb

Download Submit
memory/2172-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2172-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4976-5-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/4976-8-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/4976-11-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download