13a6ed1dd19667b6c1786988f97add9459c94f184bd74a7dbfe42ffe11a3de79

Analysis

max time kernel
1792s
max time network
1477s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2024, 11:58

Target

MPC-HC.2.1.4.x64.exe
Size

19.4MB
MD5

11abd96e10220e65d99c8504f5a418fc
SHA1

891fde187e7993d827d830a8220dc5be5bdde7dc
SHA256

13a6ed1dd19667b6c1786988f97add9459c94f184bd74a7dbfe42ffe11a3de79
SHA512

7330b8bd902bccbd25d97b55b58f9cf0bd5f22c411a5972753c1524ff28df17ab05df3d538fcbb59dae070b4970b5c634158a19a7536122db253eab3a81fb241
SSDEEP

393216:GPliBzNy+SaOyTFwC/M0RHljy832k5wL7lGVVL1ZG2TmHbZqe:GPliBWaTiCPys5EoVVZI2Tmt

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2588	MPC-HC.2.1.4.x64.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 2588	3668	MPC-HC.2.1.4.x64.exe	87
PID 3668 wrote to memory of 2588	3668	MPC-HC.2.1.4.x64.exe	87
PID 3668 wrote to memory of 2588	3668	MPC-HC.2.1.4.x64.exe	87

C:\Users\Admin\AppData\Local\Temp\MPC-HC.2.1.4.x64.exe
"C:\Users\Admin\AppData\Local\Temp\MPC-HC.2.1.4.x64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Users\Admin\AppData\Local\Temp\is-66Q9V.tmp\MPC-HC.2.1.4.x64.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-66Q9V.tmp\MPC-HC.2.1.4.x64.tmp" /SL5="$7004A,19702848,185856,C:\Users\Admin\AppData\Local\Temp\MPC-HC.2.1.4.x64.exe"
  2⤵
  - Executes dropped EXE
  PID:2588

C:\Users\Admin\AppData\Local\Temp\is-66Q9V.tmp\MPC-HC.2.1.4.x64.tmp

Filesize
1.2MB

MD5
97e8309859a8f2e96633f3abad8727f0

SHA1
ce2ef7c09f5aa0ed58dad798aad65ddc339dd22f

SHA256
90df18eb06d199c583544f179b1bb466a6fd59736d4b0dbac35c8dd3fba9a425

SHA512
8fd3450d77ce409b2621fd04475636431b57a4301a883b831b17cdf19ba345dd7d827a9076c11383697e4eab19d3060de8e67ecaee6d0b9f79b2201e5a773160

Download Submit
memory/2588-6-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/2588-9-0x0000000000400000-0x000000000053D000-memory.dmp

Filesize
1.2MB

Download
memory/2588-12-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/3668-0-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3668-2-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3668-8-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download