527220a6dcd4f634c9f5e59c8e3f1742c7dfef13e0b53b8b28bc03e0452c8927

Analysis

max time kernel
91s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2024, 01:30

Target

8de078bfea2d74a72d767bc0a83b56e5.exe
Size

1.9MB
MD5

8de078bfea2d74a72d767bc0a83b56e5
SHA1

56b670c368760489bd4c32ccdc0b49bca0625ed3
SHA256

527220a6dcd4f634c9f5e59c8e3f1742c7dfef13e0b53b8b28bc03e0452c8927
SHA512

796f71297d2d46b5cec0b5ab05f4ffde161985fb9d60179d1923bdf56c8453bf574dea7b115d619110d91199d729e8b1b86637173ea910bafe7f38feb1ae5138
SSDEEP

49152:Qoa1taC070d4Fdzydzv7JU4U9y+P6MePQW053SU:Qoa1taC09OJU4Uc+P4u3SU

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3596	4B9F.tmp

Executes dropped EXE 1 IoCs

pid	Process
3596	4B9F.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 3596	1916	8de078bfea2d74a72d767bc0a83b56e5.exe	84
PID 1916 wrote to memory of 3596	1916	8de078bfea2d74a72d767bc0a83b56e5.exe	84
PID 1916 wrote to memory of 3596	1916	8de078bfea2d74a72d767bc0a83b56e5.exe	84

C:\Users\Admin\AppData\Local\Temp\8de078bfea2d74a72d767bc0a83b56e5.exe
"C:\Users\Admin\AppData\Local\Temp\8de078bfea2d74a72d767bc0a83b56e5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Users\Admin\AppData\Local\Temp\4B9F.tmp
  "C:\Users\Admin\AppData\Local\Temp\4B9F.tmp" --splashC:\Users\Admin\AppData\Local\Temp\8de078bfea2d74a72d767bc0a83b56e5.exe 62326FC7097376CF2575CCFFC78AF9DD243A919B9D58E5919D328D868F817B08F0722468222BDD6F795582DBEE43CA0B8DC57A625BB2743B544FF2C76F1D5319
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3596

C:\Users\Admin\AppData\Local\Temp\4B9F.tmp

Filesize
1.9MB

MD5
62ead9b441494d706b3865bb2f6388d3

SHA1
518ac599cc4f66824b4428f90622c053b6a8aa99

SHA256
5e0c322036f839639cb288279d747f850872446995a3bf91992539b35bdcf88b

SHA512
1d1ee9c9d02c2d8a6aec9000e48dc18c8c8f8af920a00150368037bf89dcb5f0f66c54a48ae85ac5d4bcdd5538b1577e69f22dba05183ee1c94083612828dda1

Download Submit
memory/1916-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/3596-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download