c78bcf1772ccf48812e74a660a0f25d4f804ba66d7532b689bccce7c68d96abd

Analysis

max time kernel
91s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 01:47

Target

736a1fb45e9f7a1914b18fce28939e9b.exe
Size

1.5MB
MD5

736a1fb45e9f7a1914b18fce28939e9b
SHA1

41fe9c1c3e799f611b57d18c0857f5321dd7490d
SHA256

c78bcf1772ccf48812e74a660a0f25d4f804ba66d7532b689bccce7c68d96abd
SHA512

8954110bbd22cde25d5eb7b2ab5b433f88cd8fc535e83c1aa1b93ba3d1309497b67a3ab7a189dc454bffe6d3724ef8cd39d4e30579b1bc7ae120bfd9014afe80
SSDEEP

24576:e9dG37Vk0R07Qanm9shznM/dX59TfDzF5FFKWLnjV6IgzISqV5cRskJgjqnno:lrq0R07QQmuZMD9T7R5j5MqXNqno

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2472	EE0.tmp

Executes dropped EXE 1 IoCs

pid	Process
2472	EE0.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2472	1960	736a1fb45e9f7a1914b18fce28939e9b.exe	88
PID 1960 wrote to memory of 2472	1960	736a1fb45e9f7a1914b18fce28939e9b.exe	88
PID 1960 wrote to memory of 2472	1960	736a1fb45e9f7a1914b18fce28939e9b.exe	88

C:\Users\Admin\AppData\Local\Temp\736a1fb45e9f7a1914b18fce28939e9b.exe
"C:\Users\Admin\AppData\Local\Temp\736a1fb45e9f7a1914b18fce28939e9b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Users\Admin\AppData\Local\Temp\EE0.tmp
  "C:\Users\Admin\AppData\Local\Temp\EE0.tmp" --pingC:\Users\Admin\AppData\Local\Temp\736a1fb45e9f7a1914b18fce28939e9b.exe 56E6AE0160A7513C2180E7316C12968C36BECEE56719651A03938622C852111B1C8C976ABECC8C2255CF774835142F144F9FFBE45D67DF8272CF15BD70EFC49E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2472

C:\Users\Admin\AppData\Local\Temp\EE0.tmp

Filesize
1.5MB

MD5
822469a68a1e2f333c67c4de2841edf8

SHA1
24cfd25e614552a0f761c28ded23b90cd682375b

SHA256
acdae95af05ec21f9e25b9d83ca8dc708e28553e571b70120a37e16df0ea0aff

SHA512
704d236b4a2e9cc668ad550987ae0bd00d89fbf55189e04b756a5b61ecf6e1c1462a373f62777700c5ed3c5a8ecadd22775c99a1bc5dc11e9730c0de93dd0e43

Download Submit
memory/1960-1-0x0000000002910000-0x000000000298A000-memory.dmp

Filesize
488KB

Download
memory/1960-0-0x0000000000EA0000-0x000000000106E000-memory.dmp

Filesize
1.8MB

Download
memory/2472-7-0x0000000000D80000-0x0000000000F4E000-memory.dmp

Filesize
1.8MB

Download
memory/2472-8-0x0000000002FA0000-0x000000000301A000-memory.dmp

Filesize
488KB

Download