637fbcc01941c0faa82ed6d3510bc5a33d9dac4e6fae466ebd6c14eab66be7e4

Analysis

max time kernel
4s
max time network
4s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12/02/2024, 14:41

Target

Patch.exe
Size

9.2MB
MD5

9b9538176eae68545c53a2bb4567c3d6
SHA1

7ded8138bfaa013350ac86c4d0bd26dab3fcd779
SHA256

637fbcc01941c0faa82ed6d3510bc5a33d9dac4e6fae466ebd6c14eab66be7e4
SHA512

e919e0a2a1d285d01d3941943ed3392a2f7eae451f69348290eff89fee7129ccbe9fb363f0792c01d0ec0e0c7c6e4768dc42440cd7a41f670ee4d9682ee0dff2
SSDEEP

196608:DfAjZmfg8Per1xYhbAJkChSlLoGDkBYMFKxRfZpHPrq:DfuZmfg8PexUfChnhBlKrf3jq

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2304	Patch.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2304	1996	Patch.exe	84
PID 1996 wrote to memory of 2304	1996	Patch.exe	84
PID 1996 wrote to memory of 2304	1996	Patch.exe	84

C:\Users\Admin\AppData\Local\Temp\Patch.exe
"C:\Users\Admin\AppData\Local\Temp\Patch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Users\Admin\AppData\Local\Temp\is-VOE8I.tmp\Patch.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-VOE8I.tmp\Patch.tmp" /SL5="$600DE,8520993,57344,C:\Users\Admin\AppData\Local\Temp\Patch.exe"
  2⤵
  - Executes dropped EXE
  PID:2304

C:\Users\Admin\AppData\Local\Temp\is-VOE8I.tmp\Patch.tmp

Filesize
904KB

MD5
bda5302537ac7704df91314ced637307

SHA1
ac1e6b7aa65dc928c0eb8c0c1292f4808c2e2a15

SHA256
1fccc2b04917eb1cd667f80fc0641802cb770cc9ee82f3f7b571471bfc98fcfd

SHA512
57e34f3255ce87509e82f4d701e40a2ec014ba20618f8ccc83402fbeabd4b1b05b38e65889bc251b7aeb1b01c04c020dd65a54aa4661d7af68960e1dbb91093b

Download Submit
memory/1996-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1996-2-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2304-10-0x0000000002700000-0x0000000002701000-memory.dmp

Filesize
4KB

Download