0de904140098da3a4fe9786a3de8831f6ab090fadb7c5c18713c7ed55454a700

Analysis

max time kernel
138s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01-02-2024 05:50

Target

86193ce69eaffc900d39f6c42dd0460b.exe
Size

1.9MB
MD5

86193ce69eaffc900d39f6c42dd0460b
SHA1

6442540b9de49b29bd16df80ea8745d285abb6cc
SHA256

0de904140098da3a4fe9786a3de8831f6ab090fadb7c5c18713c7ed55454a700
SHA512

9baea106dba673a9264e30a18c489106547a3b021f97d65acd438c118971af7f7f00f315da1995537f2dc771ba787e52d619c3a88965da3d73ff8b1704c6c474
SSDEEP

49152:Qoa1taC070dvisoD8OBXcZNHsLbeCdlXHa11vOnu4p:Qoa1taC00oQOBXcnsOCdl67OZp

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1092	E8BA.tmp

Executes dropped EXE 1 IoCs

pid	Process
1092	E8BA.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 1092	4512	86193ce69eaffc900d39f6c42dd0460b.exe	84
PID 4512 wrote to memory of 1092	4512	86193ce69eaffc900d39f6c42dd0460b.exe	84
PID 4512 wrote to memory of 1092	4512	86193ce69eaffc900d39f6c42dd0460b.exe	84

C:\Users\Admin\AppData\Local\Temp\86193ce69eaffc900d39f6c42dd0460b.exe
"C:\Users\Admin\AppData\Local\Temp\86193ce69eaffc900d39f6c42dd0460b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Users\Admin\AppData\Local\Temp\E8BA.tmp
  "C:\Users\Admin\AppData\Local\Temp\E8BA.tmp" --splashC:\Users\Admin\AppData\Local\Temp\86193ce69eaffc900d39f6c42dd0460b.exe EB39B81242AD3E3D29FB87D1C692672E581E12EF6F6F95E9EC59AA7B18DC498F5DD7F037ED6F2865DCB6DA811B17EF9E84B54077D0286CC0A2381D51BA105753
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1092

C:\Users\Admin\AppData\Local\Temp\E8BA.tmp

Filesize
1.9MB

MD5
d97a88a59a8d1dfd79933b958b1ede4e

SHA1
bb0898727076a74a6497eb49f716805351d52f94

SHA256
ae0e504bfca3a40cfa86d41ff37ecd97d9d2fb33abac58769436732b2467aec6

SHA512
ba39dedf43cdc2beea1fae0a03e4dd8c14c6824084b34268b93422e75672e6a68e6d8a15bc7dda56d86996bad7f4806551db4bffcac54950b7dff080d4b6725d

Download Submit
memory/1092-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4512-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download