82302c80203150cce4db7198064c3841642cc10ab53ce81b99b94bd379bdd422

Analysis

max time kernel
120s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 11:17

Target

9b8855c6388abfa633eafa57ac562222.exe
Size

1.9MB
MD5

9b8855c6388abfa633eafa57ac562222
SHA1

af9dfb8889abe8a732ee9856b8ffa7c21d1a79e5
SHA256

82302c80203150cce4db7198064c3841642cc10ab53ce81b99b94bd379bdd422
SHA512

ddd6ec21d91e3cd461e5c30a6e09bb66231311cd838ecc80e990a0d6a4c8381596f37ec3d3d3c8c72e35f5e41143e30a6a6025fe1270190608df33dbf00a307c
SSDEEP

49152:Qoa1taC070dCaresjV+S1/k+AxwH5yyQuN2UJ8TEwwadkSiGv/:Qoa1taC0BJlSdk+AxwZytrg8TJFd7iG3

Score

7^/10

Deletes itself 1 IoCs

pid	Process
5068	7C35.tmp

Executes dropped EXE 1 IoCs

pid	Process
5068	7C35.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 920 wrote to memory of 5068	920	9b8855c6388abfa633eafa57ac562222.exe	84
PID 920 wrote to memory of 5068	920	9b8855c6388abfa633eafa57ac562222.exe	84
PID 920 wrote to memory of 5068	920	9b8855c6388abfa633eafa57ac562222.exe	84

C:\Users\Admin\AppData\Local\Temp\9b8855c6388abfa633eafa57ac562222.exe
"C:\Users\Admin\AppData\Local\Temp\9b8855c6388abfa633eafa57ac562222.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:920
- C:\Users\Admin\AppData\Local\Temp\7C35.tmp
  "C:\Users\Admin\AppData\Local\Temp\7C35.tmp" --splashC:\Users\Admin\AppData\Local\Temp\9b8855c6388abfa633eafa57ac562222.exe 1F449E1869A7CFF883BF83D3617993D1079D5C1161C405E69F7320FC0194AE1730C1494FA83AEACD373726E585CDF7875E897001223F809480ED9573B10C1CFE
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:5068

C:\Users\Admin\AppData\Local\Temp\7C35.tmp

Filesize
1.9MB

MD5
cdb9a2f4c09a6f1b3fbb2b5a29035077

SHA1
c19231365a018d5dee6c1de12c5cc76287f63d8f

SHA256
5c33aaa9cffd18d06de9f0d6679d982605ac8d1a899729f71ae4ed1ddc1be979

SHA512
155c3a027449ae64a48b0869954f3c806cf67982ce5cb8a80f1d00294cd9b7aa5db40165fee632efd26569057880aca5c3e73a582334ff79c45d2f9841730327

Download Submit
memory/920-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/5068-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download