7b1cf1979579775f48e8d20974753453f75963b3094d3b95519d9362e943dbbb

Analysis

max time kernel
92s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
04-02-2024 08:58

Target

IDWCH2.exe
Size

739KB
MD5

0d5cc91890c411599e994ab4d927350b
SHA1

b64c4752537fc05bd460918fe252ef64e72d2651
SHA256

b64cc3011b334fe3fdc47852da28f1d865a1f71dd819827a035b9b3adab1a163
SHA512

56418a6586f0cc7f985e944811744fdce2ddaea5e238d02b21435768a3738ba7cccc738190b677f0eb66916a24cdcd4b63701df8a35c7a44802ba053ccdf059b
SSDEEP

6144:d/QiQXC45m+ksmpk3U9j0IeP2soxvjFEOTb9WmZX/8shzdsY4CpHPhnq/FK:VQi34c6m6UR0IeP2p1hf39Wkv8xwJqdK

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
756	IDWCH2.tmp

Loads dropped DLL 1 IoCs

pid	Process
756	IDWCH2.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3268 wrote to memory of 756	3268	IDWCH2.exe	37
PID 3268 wrote to memory of 756	3268	IDWCH2.exe	37
PID 3268 wrote to memory of 756	3268	IDWCH2.exe	37

C:\Users\Admin\AppData\Local\Temp\IDWCH2.exe
"C:\Users\Admin\AppData\Local\Temp\IDWCH2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Users\Admin\AppData\Local\Temp\is-50AS3.tmp\IDWCH2.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-50AS3.tmp\IDWCH2.tmp" /SL5="$C002E,506127,422400,C:\Users\Admin\AppData\Local\Temp\IDWCH2.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:756

C:\Users\Admin\AppData\Local\Temp\is-50AS3.tmp\IDWCH2.tmp

Filesize
567KB

MD5
0783f47078e0316d06dd810cafab94c8

SHA1
2a2640f4dd812b028df18fbffb4d6286226d5d17

SHA256
378077888bbe2cd6d45b00b3315404205bc36e2beeae83682ef8b45df01099cb

SHA512
008cd76046845b45d67c7fec550c152d44afae1945a3294cc9f5e7c4a80bed12983953bb74bc2aeadab3c95762e60b761913227450f67bb7d263e636c085c6e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-GRB73.tmp\idp.dll

Filesize
216KB

MD5
8f995688085bced38ba7795f60a5e1d3

SHA1
5b1ad67a149c05c50d6e388527af5c8a0af4343a

SHA256
203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006

SHA512
043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35

Download Submit
memory/756-6-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/756-18-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/3268-0-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/3268-2-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/3268-20-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download