13dc4eb8953ceca2ca5c954a380823686c6ef9062fbb186c2d41bdd5eedd7ae2

Analysis

max time kernel
134s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2024, 12:57

Target

656df264bc16a3c58958700e1b45e7b8.exe
Size

1.9MB
MD5

656df264bc16a3c58958700e1b45e7b8
SHA1

01d12811a78dbc0860b4da2c1fde718155b89318
SHA256

13dc4eb8953ceca2ca5c954a380823686c6ef9062fbb186c2d41bdd5eedd7ae2
SHA512

0ca0b47dacccaa4b9929520eff6cd6a3b280445b77543f9a960b31c2523d4b1fc904e64c1c83dfa7e269d92f9816b2e57a65e57d27348b44a3dfb0b44afcda01
SSDEEP

49152:Qoa1taC070dBfbL2/PYwwvxTGpi5QE+NNAotNiB:Qoa1taC0WewhxTCxNNAoCB

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2528	4E6E.tmp

Executes dropped EXE 1 IoCs

pid	Process
2528	4E6E.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2528	2988	656df264bc16a3c58958700e1b45e7b8.exe	90
PID 2988 wrote to memory of 2528	2988	656df264bc16a3c58958700e1b45e7b8.exe	90
PID 2988 wrote to memory of 2528	2988	656df264bc16a3c58958700e1b45e7b8.exe	90

C:\Users\Admin\AppData\Local\Temp\656df264bc16a3c58958700e1b45e7b8.exe
"C:\Users\Admin\AppData\Local\Temp\656df264bc16a3c58958700e1b45e7b8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Users\Admin\AppData\Local\Temp\4E6E.tmp
  "C:\Users\Admin\AppData\Local\Temp\4E6E.tmp" --splashC:\Users\Admin\AppData\Local\Temp\656df264bc16a3c58958700e1b45e7b8.exe FC0A43B148DCF16561AAAF58A51909AC5A1F025B12D4A02E24911ECFFE7CE8845801F40A1028C02561EB0FA8B01E0AF3918D353C49092763FE9C5C4D4FC0D23A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2528

C:\Users\Admin\AppData\Local\Temp\4E6E.tmp

Filesize
1.9MB

MD5
343bdcdfc9b05e9c906228d781a130de

SHA1
edd14f0b9d48e69180e244d7bf86c4ad0a93adf1

SHA256
70f4a0436b26fd6d56d7be81fb9c7d0c276e4c74cf7b4a12e86f812c588bcc27

SHA512
d798fe90eead6cff7468ad20a759bffc0490ce4e1d62640cb1a62fe97bed529ad5b12e27ccc085b5e66050a680040402c5e778877ea652139ab1f26179e5a32e

Download Submit
memory/2528-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/2988-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download