b6355fd0e2471f44d90abe120671dc928ce2dafa3e3bee018355837598a0e9eb

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14-02-2024 08:39

Target

9b398ad7a8fe54c90924c4b8962268ca.exe
Size

1.9MB
MD5

9b398ad7a8fe54c90924c4b8962268ca
SHA1

5c0b9f1108ca79a6b6cccfdd5ad479903add27a4
SHA256

b6355fd0e2471f44d90abe120671dc928ce2dafa3e3bee018355837598a0e9eb
SHA512

10ea20ee2893da173b4b477ba7f63866988e9397baa5f597140ecbb830cef17e3cc3ee00e24be9d5e89b03c2fa1299234828005051a516cc292d1f31431c753a
SSDEEP

49152:Qoa1taC070dS3j5Jb7LC4ocA8cD9lOaao:Qoa1taC0bjLbq4DcD933

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1944	4B90.tmp

Executes dropped EXE 1 IoCs

pid	Process
1944	4B90.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 1944	5048	9b398ad7a8fe54c90924c4b8962268ca.exe	87
PID 5048 wrote to memory of 1944	5048	9b398ad7a8fe54c90924c4b8962268ca.exe	87
PID 5048 wrote to memory of 1944	5048	9b398ad7a8fe54c90924c4b8962268ca.exe	87

C:\Users\Admin\AppData\Local\Temp\9b398ad7a8fe54c90924c4b8962268ca.exe
"C:\Users\Admin\AppData\Local\Temp\9b398ad7a8fe54c90924c4b8962268ca.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Users\Admin\AppData\Local\Temp\4B90.tmp
  "C:\Users\Admin\AppData\Local\Temp\4B90.tmp" --splashC:\Users\Admin\AppData\Local\Temp\9b398ad7a8fe54c90924c4b8962268ca.exe 03DA1A32EBBBCC85B1C13798C08422F62A69C05B21FA92D53B6EDE0F4669C76D1E80189D92FD549D541367D77F4E93613271C068A2ED52F0A2D8EF137868B7A9
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1944

C:\Users\Admin\AppData\Local\Temp\4B90.tmp

Filesize
1.9MB

MD5
dc1fab05c7dc84a8cac7e13338df69b7

SHA1
27139856f8240f10aa5157aaa6e492a15e4d62b6

SHA256
6b5a4f34d924284f45c25fbec0ff61c64b2c217bc0e6d4499ae2ce90d0f0350b

SHA512
287e54302672d05829ab6dddb5753609d91a8b4e644ce56f4024fe02b4fa43a4c699a53db6b7659046b78e7ed38261d41a4eeb34f1765509dd5fa0229a6219ed

Download Submit
memory/1944-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/5048-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download