49a4495baa65855a68d32fd5fc980147c47899a09c3b1d964055e1e4ad82afc1

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 10:19

Target

992af39606e42e4e27656416217cface.exe
Size

1.1MB
MD5

992af39606e42e4e27656416217cface
SHA1

4fd6dba1e514d3572649de427cef6ea23068a33d
SHA256

49a4495baa65855a68d32fd5fc980147c47899a09c3b1d964055e1e4ad82afc1
SHA512

62d38bcdf01c667351fd73b0841ad6d9b473199da7a617cf6129476aef3707c15f396278372b149c4935b0c18e1fb5a787dfdd55daaa46984acdbc2c66e6c86a
SSDEEP

24576:7zXKqa8SEijjC+37liXbLbklmfB6/tbQdSmKBQXj3Ly:7z6qaakjC+3srLAKB61bQd3KaXb+

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2656	tl.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\aeyxrine\tl.exe	992af39606e42e4e27656416217cface.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 2656	4308	992af39606e42e4e27656416217cface.exe	83
PID 4308 wrote to memory of 2656	4308	992af39606e42e4e27656416217cface.exe	83
PID 4308 wrote to memory of 2656	4308	992af39606e42e4e27656416217cface.exe	83

C:\Users\Admin\AppData\Local\Temp\992af39606e42e4e27656416217cface.exe
"C:\Users\Admin\AppData\Local\Temp\992af39606e42e4e27656416217cface.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Program Files (x86)\aeyxrine\tl.exe
  "C:\Program Files (x86)\aeyxrine\tl.exe"
  2⤵
  - Executes dropped EXE
  PID:2656

C:\Program Files (x86)\aeyxrine\tl.exe

Filesize
1.1MB

MD5
37838c32da9f5768a8765f1166714c97

SHA1
df4608e931767667b7fbf1c7961e8f5625cbb597

SHA256
c5b0b5af03b832955b833c70b62f19985536263f9c89cbd7bafb17d6b5d090ab

SHA512
202900604c1685338afedc35db668b8a9fe2d9bcf436a4f3e91f96969bdc2a883f714ec1d74da48bf1f846cc287b1c161e3ebfd0322febd996d44a465e721508

Download Submit
memory/2656-8-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2656-9-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4308-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4308-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4308-7-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download