e079444a54b4c2737a260d9fa5efa45a43d654e509ea4a858a292f9c021b4f7a

Analysis

max time kernel
141s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
04-02-2024 08:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8eb9e4031f86497e43b16806ef081eb2.exe
Size

9.8MB
MD5

8eb9e4031f86497e43b16806ef081eb2
SHA1

5ac1aacb0a9ff1e0150cf5822f20af5aab0e0f52
SHA256

e079444a54b4c2737a260d9fa5efa45a43d654e509ea4a858a292f9c021b4f7a
SHA512

754520d0d00a23100b90eb31a625c9dd696b62a909e6486acc09c8c142b6b9bcc8d6bcd1a5ced44df14312bb3f18dca23d4cb4d06572d53a17e21809928ac6d3
SSDEEP

196608:W3+LnW0yrMqy2Wan2TOL/LnYw9ctsHN0c4ByKVFaK1FgnoHWnc:DXyHvDotgNx4ByuFxMn1nc

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2312	8eb9e4031f86497e43b16806ef081eb2.tmp

Loads dropped DLL 2 IoCs

pid	Process
2312	8eb9e4031f86497e43b16806ef081eb2.tmp
2312	8eb9e4031f86497e43b16806ef081eb2.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2312	2472	8eb9e4031f86497e43b16806ef081eb2.exe	88
PID 2472 wrote to memory of 2312	2472	8eb9e4031f86497e43b16806ef081eb2.exe	88
PID 2472 wrote to memory of 2312	2472	8eb9e4031f86497e43b16806ef081eb2.exe	88

C:\Users\Admin\AppData\Local\Temp\8eb9e4031f86497e43b16806ef081eb2.exe
"C:\Users\Admin\AppData\Local\Temp\8eb9e4031f86497e43b16806ef081eb2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Users\Admin\AppData\Local\Temp\is-FR2R4.tmp\8eb9e4031f86497e43b16806ef081eb2.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-FR2R4.tmp\8eb9e4031f86497e43b16806ef081eb2.tmp" /SL5="$50066,9735829,380928,C:\Users\Admin\AppData\Local\Temp\8eb9e4031f86497e43b16806ef081eb2.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-AO31T.tmp\VerEdit.dll

Filesize
87KB

MD5
2b3a2a48842cb476bb151467fcf168aa

SHA1
f0b30e8091f19b6987b624a4414c8ba6cf7ceee8

SHA256
5b66f6a9e2fbd147f5dedfb23068f645582c5dfda04aa4807a96abb1004be9b9

SHA512
8f0a1d307aa99fdeb67142b391160e0531b445babaf41ed94c05f39dd7b13428254953fdced7b542c24804e28515b3f5d558ea8027d36e10d7cded049d77828e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-FR2R4.tmp\8eb9e4031f86497e43b16806ef081eb2.tmp

Filesize
1.0MB

MD5
9d457e696dffb8ad00b591cc93b54101

SHA1
cdb45337b6013ca3a43fdd54094b3506ca7db4c7

SHA256
b8b1f4e33fc02b053d7cf6a92784c02715f7e678fcfc424a8b9abd27e2e99a76

SHA512
ef9db6a915d57d15b76063baf652334fc005f80ec6fb01c35f9a4c2d55b709bab34f3f214f732ea0dba0daf07046b3868ad37a5676c3b61e93a1cff832737186

Download Submit
memory/2312-7-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/2312-17-0x0000000003AE0000-0x0000000003AFF000-memory.dmp

Filesize
124KB

Download
memory/2312-21-0x0000000000400000-0x0000000000511000-memory.dmp

Filesize
1.1MB

Download
memory/2312-22-0x0000000003AE0000-0x0000000003AFF000-memory.dmp

Filesize
124KB

Download
memory/2312-26-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/2312-29-0x0000000003AE0000-0x0000000003AFF000-memory.dmp

Filesize
124KB

Download
memory/2472-0-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2472-2-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2472-20-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads