6162925e04cea841bf7de52ee91c146eac21902daf115cb93397b1735d97dfba

Analysis

max time kernel
92s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/02/2024, 05:02

Target

8600087701f97db10701ced6f928c52d.exe
Size

1.9MB
MD5

8600087701f97db10701ced6f928c52d
SHA1

ba4f73245f409ed350ef9fdc3a41e5ab462b32f0
SHA256

6162925e04cea841bf7de52ee91c146eac21902daf115cb93397b1735d97dfba
SHA512

751c600a35f8a5d89a8517b35f27f268d5e91962c7de31a8a98dcb45c038daa6e47ae6a1cc78f3ae5a503b0323a23bbd12de27a26b1116264c4ae1fa6b0de999
SSDEEP

24576:N2oo60HPdt+1CRiY2eOBvcj3u10deprzw/uZTfRSQ5CvUwTCBSS2RYrPmwfmxLxd:Qoa1taC070d4MuyQ5wZTCBSSvPRexLv

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1584	49DA.tmp

Executes dropped EXE 1 IoCs

pid	Process
1584	49DA.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 1584	4924	8600087701f97db10701ced6f928c52d.exe	51
PID 4924 wrote to memory of 1584	4924	8600087701f97db10701ced6f928c52d.exe	51
PID 4924 wrote to memory of 1584	4924	8600087701f97db10701ced6f928c52d.exe	51

C:\Users\Admin\AppData\Local\Temp\8600087701f97db10701ced6f928c52d.exe
"C:\Users\Admin\AppData\Local\Temp\8600087701f97db10701ced6f928c52d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Users\Admin\AppData\Local\Temp\49DA.tmp
  "C:\Users\Admin\AppData\Local\Temp\49DA.tmp" --splashC:\Users\Admin\AppData\Local\Temp\8600087701f97db10701ced6f928c52d.exe D519867A54A9C921F4FDAD9E4DAA9E04E382308071926283773EA7F8CAE8BFE01FDFC980D1F0DE9FD7AE059AEBAFEE4E2256639B088201C8FB2C4AB084B4B1A8
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1584

C:\Users\Admin\AppData\Local\Temp\49DA.tmp

Filesize
65KB

MD5
7be6e53a7a6a222a83fb18d9f55a7a64

SHA1
319d9c8ae35f119c7cffbc8a9486f3f639ebd675

SHA256
d1b131936753ee608f9489e752119ee64aa2695e0def0c62c7affd9c0ebf7d17

SHA512
322c2291ba3e4b33fb17988a3eed9937ab7249d69ba48011fe4f7357c8c227a4212f0da9882eb0d4d3e83a03c3f99df7ad926552aab2f7f515222026a0eb5ee9

Download Submit
C:\Users\Admin\AppData\Local\Temp\49DA.tmp

Filesize
24KB

MD5
19546609a74bba5cdcf0496aed08795c

SHA1
a48445a8014482c7c85a4a094dc81ddf566e6853

SHA256
c3e1e475a61bd79c62993d4d6d095e9d3504a62af1fd5ded74d7d2ab9f6a19e0

SHA512
5a0c7597d91689057f4147bd3f84c0ddd27d3778f2a868513ea1e9f9e79f33721d5a467a968a9c393b314cd924f7711653d8474ae94a712cb152dfa8d5dfa8d1

Download Submit
memory/1584-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4924-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download