c25314e65e6b0b7a8bfd8c9b2f42dc60e0b1954ffe8317e2a1374528a149b9ec

Analysis

max time kernel
90s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14-02-2024 06:28

Target

9afe77f032ee59840c941feeb3a5cf60.exe
Size

1.9MB
MD5

9afe77f032ee59840c941feeb3a5cf60
SHA1

3bf8a4dfa0287332833492081676e412a89a762b
SHA256

c25314e65e6b0b7a8bfd8c9b2f42dc60e0b1954ffe8317e2a1374528a149b9ec
SHA512

d38de56ecbe1b84e85bfb44075ad307569e3af6b1e940cb16199b10df937e2e4d32bf991b5a0d7133be649c353600e3c0aef8178901cd6dd345b58cc690184be
SSDEEP

49152:Qoa1taC070dWySuNfyWeKnl1S4hdnVrXFBY:Qoa1taC0PkyDKnl1S4zVrXnY

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4668	4BED.tmp

Executes dropped EXE 1 IoCs

pid	Process
4668	4BED.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 4668	4908	9afe77f032ee59840c941feeb3a5cf60.exe	84
PID 4908 wrote to memory of 4668	4908	9afe77f032ee59840c941feeb3a5cf60.exe	84
PID 4908 wrote to memory of 4668	4908	9afe77f032ee59840c941feeb3a5cf60.exe	84

C:\Users\Admin\AppData\Local\Temp\9afe77f032ee59840c941feeb3a5cf60.exe
"C:\Users\Admin\AppData\Local\Temp\9afe77f032ee59840c941feeb3a5cf60.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Users\Admin\AppData\Local\Temp\4BED.tmp
  "C:\Users\Admin\AppData\Local\Temp\4BED.tmp" --splashC:\Users\Admin\AppData\Local\Temp\9afe77f032ee59840c941feeb3a5cf60.exe ED7D8AA439B8554067C9300E58E3C0E5EE06CEE90B3D49600C21CAA68B4AD4B51F9C104DAC2271A2DBBDB605CB474FD66B3D60FDFDA2F6FA80AD572C33AF8749
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4668

C:\Users\Admin\AppData\Local\Temp\4BED.tmp

Filesize
1.9MB

MD5
62a4173a1dab78510ce124ab92c25033

SHA1
fcfdc1fb89df5a9953b6b8f09be7495adaa54e46

SHA256
d1291c9d6a464d1bfa71f6c3c97022aa522be9bdce2d56872dc02c737340e0ac

SHA512
44c77ff8b00ac0e0eec390c5eba75fa6ba4321f902c0920338e106412cd032c7ce36735efcda7f27c50a1def5f89d13f90cf90032267648234c2c9c23541c2ed

Download Submit
memory/4668-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4908-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download