1b80ff6df4bc33bc79232eb3497ba6b7eb345f7c84f72c2726e38555f74acd1d

Analysis

max time kernel
143s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2024, 22:56

Target

7311e2d0d256931d258c02b4b373f0f1.exe
Size

1.9MB
MD5

7311e2d0d256931d258c02b4b373f0f1
SHA1

505fadb13cd328c28d66f887d38a76dfa95bf8e4
SHA256

1b80ff6df4bc33bc79232eb3497ba6b7eb345f7c84f72c2726e38555f74acd1d
SHA512

67417171af2e9d26636f81dd20b960879862d325d060eb6486963feed393e0cde08560d90ae14a69eda4df87ee68a5bca8163bef7a54f910a37d5db70a149ab7
SSDEEP

49152:Qoa1taC070d9LG+lOcZ5JeNmTrXJz5hq2:Qoa1taC0kLDlN5uarRa2

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3528	71B5.tmp

Executes dropped EXE 1 IoCs

pid	Process
3528	71B5.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 3528	1108	7311e2d0d256931d258c02b4b373f0f1.exe	88
PID 1108 wrote to memory of 3528	1108	7311e2d0d256931d258c02b4b373f0f1.exe	88
PID 1108 wrote to memory of 3528	1108	7311e2d0d256931d258c02b4b373f0f1.exe	88

C:\Users\Admin\AppData\Local\Temp\7311e2d0d256931d258c02b4b373f0f1.exe
"C:\Users\Admin\AppData\Local\Temp\7311e2d0d256931d258c02b4b373f0f1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Users\Admin\AppData\Local\Temp\71B5.tmp
  "C:\Users\Admin\AppData\Local\Temp\71B5.tmp" --splashC:\Users\Admin\AppData\Local\Temp\7311e2d0d256931d258c02b4b373f0f1.exe 86FF095BB26EFCC49112C8D76B5187390A04F6BCC92C2C747742B851B63577F6524B94776ADA973136A9BDFCA77F1B5739B9A6658EAAABE1800A1CF915AF7C7B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3528

C:\Users\Admin\AppData\Local\Temp\71B5.tmp

Filesize
1.9MB

MD5
b0dc5e69ea3683cc7190292697b44826

SHA1
b0064e931ef03d8c02ae6d443d7290f4b088da17

SHA256
e87451b221bc1d5546ddfcc01f5f2050695d73e2e5452a299559075d0c2869cf

SHA512
b4bb7449a925f960bf687d9076bf6144b08734423d0caf5d0d3bc86c26f2860e6d5c2a62e440d499cc424eb5e6e34c430d41e508c597d7e5c74b2a9cfb44b999

Download Submit
memory/1108-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/3528-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download