5446014f6ed23b74dac86e15dbda4bf8bf9662e874b6caabd63418ca5ccfe24e

Analysis

max time kernel
138s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
29/01/2024, 17:26

Target

806f68ca74e59b5ce4ad259b37dd65f2.exe
Size

1.1MB
MD5

806f68ca74e59b5ce4ad259b37dd65f2
SHA1

fcbd5982b7e6775b9a39d3f1d96f8e68f930e8f7
SHA256

5446014f6ed23b74dac86e15dbda4bf8bf9662e874b6caabd63418ca5ccfe24e
SHA512

b9af2fd6efbc250578773627f18e9233bb31a7477a2be0b77157a48fbdcee7a8974240fe420053201aea991565a1274dec68fbfd2bb3629476feefc7722d6d4d
SSDEEP

24576:SypW9SgLNZaOdcTMuUvxIgR5tm1yKsoSUEfksdhbLEzU+87kMX9qJGTY:St9SgLNZa6xICC031kChbw187M0Y

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4848	4AD4.tmp

Executes dropped EXE 1 IoCs

pid	Process
4848	4AD4.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 4848	1848	806f68ca74e59b5ce4ad259b37dd65f2.exe	86
PID 1848 wrote to memory of 4848	1848	806f68ca74e59b5ce4ad259b37dd65f2.exe	86
PID 1848 wrote to memory of 4848	1848	806f68ca74e59b5ce4ad259b37dd65f2.exe	86

C:\Users\Admin\AppData\Local\Temp\806f68ca74e59b5ce4ad259b37dd65f2.exe
"C:\Users\Admin\AppData\Local\Temp\806f68ca74e59b5ce4ad259b37dd65f2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Users\Admin\AppData\Local\Temp\4AD4.tmp
  "C:\Users\Admin\AppData\Local\Temp\4AD4.tmp" --pingC:\Users\Admin\AppData\Local\Temp\806f68ca74e59b5ce4ad259b37dd65f2.exe 6138E89A2AE04C2D654FEFFDB2234BCFCFF9632C0AB80FDF3A2C58A4C56FFF3BCC21B2F5F6DE60DF196F8A899E488E0CD616CFE3AFE2C95A5D09D8C264997DDF
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4848

C:\Users\Admin\AppData\Local\Temp\4AD4.tmp

Filesize
1.1MB

MD5
3be1999dde3b51c4ddd52baefa34bf1b

SHA1
c0f2009a70e2ff28ce2553aaf16c8716efe1cbd2

SHA256
461f1f0fc0e916981ef93e0b8412ceae79a156eab0a86b6cecc550cc8f0a1938

SHA512
f988caeacc0e8996cd464300f989b7751a38156f5e5580374af955951054c80f67165ec293c53980fd41de26d611d018b63a10291b63f107ff05cf38f7795b7c

Download Submit
memory/1848-0-0x0000000000A00000-0x0000000000B45000-memory.dmp

Filesize
1.3MB

Download
memory/1848-2-0x00000000010B0000-0x0000000001100000-memory.dmp

Filesize
320KB

Download
memory/4848-8-0x0000000000350000-0x0000000000495000-memory.dmp

Filesize
1.3MB

Download
memory/4848-7-0x00000000012C0000-0x0000000001310000-memory.dmp

Filesize
320KB

Download