5c53455fe4701bb994bf3cc40569b52faa95c854c6608e8959506cd95145f0f7

Analysis

max time kernel
93s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
29/01/2024, 07:35

Target

7f42d04a954d7a316f487ff178a590fb.exe
Size

1.9MB
MD5

7f42d04a954d7a316f487ff178a590fb
SHA1

e0407b4cc080fa022632c70166cb44c92291cb21
SHA256

5c53455fe4701bb994bf3cc40569b52faa95c854c6608e8959506cd95145f0f7
SHA512

f77ece75bda7d5405cd3c5ee109d6071d1123831178f5176f63242be11de495776458f9b7bfc6ee695c14ac6b1e79c0029c4d98a72bfd12b2b4d9160f2e083cb
SSDEEP

49152:Qoa1taC070dhKMsf+4jxFQuJdnO8AF8Pj9VrgG7uW5:Qoa1taC0ubsfRxFQuDwF8P5Vz1

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4648	545A.tmp

Executes dropped EXE 1 IoCs

pid	Process
4648	545A.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 4648	3444	7f42d04a954d7a316f487ff178a590fb.exe	88
PID 3444 wrote to memory of 4648	3444	7f42d04a954d7a316f487ff178a590fb.exe	88
PID 3444 wrote to memory of 4648	3444	7f42d04a954d7a316f487ff178a590fb.exe	88

C:\Users\Admin\AppData\Local\Temp\7f42d04a954d7a316f487ff178a590fb.exe
"C:\Users\Admin\AppData\Local\Temp\7f42d04a954d7a316f487ff178a590fb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Users\Admin\AppData\Local\Temp\545A.tmp
  "C:\Users\Admin\AppData\Local\Temp\545A.tmp" --splashC:\Users\Admin\AppData\Local\Temp\7f42d04a954d7a316f487ff178a590fb.exe 823D17F7BF6BD3376CA0DD2296623A0298FDEC2F2410BDD8BEF1BD5CD53D0C4F73938C4C1E224B47E4525DF5B873B5F7FC34A322896E6FC62863C9656A713510
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4648

C:\Users\Admin\AppData\Local\Temp\545A.tmp

Filesize
1.9MB

MD5
f4fe76805b6922e0f6cb7222b489bc64

SHA1
c8a79a9fa8655377323bcd97f456d94f08f66741

SHA256
a6dbb66dc8beaaaa76940634e882b5906f3d1c3559a4e704302510d97b8e76af

SHA512
479fdc9068eb3b10ff97d443bb6c22bea7a37f5984eab0d7f1082671381182b39e7b08bc098eb01d49240fc003b0e5af243bc3a6d98ddb1efbd4abf1976b8a14

Download Submit
memory/3444-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4648-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download