1861254a57c7a618b4507d5282f2587b426656fbbefea74e566e3dfc7bfd1cd1

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 11:39

Target

a1c6ca6ac53767bb9d6895f18ba2e784.exe
Size

1.9MB
MD5

a1c6ca6ac53767bb9d6895f18ba2e784
SHA1

92a70e507183298c44b3fc64dca40b4d89651f2d
SHA256

1861254a57c7a618b4507d5282f2587b426656fbbefea74e566e3dfc7bfd1cd1
SHA512

38e54921c890d53ebe500e76f79c0e2d8a693867eb5575279699690fa0bb83151155dec1bb126c80a4111fa32b07bf0aebe450f9fe3b48bbc13b711a66bd4c55
SSDEEP

49152:Qoa1taC070dTAoYulUyadMwrSa3BrcT/mQ/geTMMi:Qoa1taC0foYrhd7SOcLxwMi

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3784	606F.tmp

Executes dropped EXE 1 IoCs

pid	Process
3784	606F.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 3784	1260	a1c6ca6ac53767bb9d6895f18ba2e784.exe	88
PID 1260 wrote to memory of 3784	1260	a1c6ca6ac53767bb9d6895f18ba2e784.exe	88
PID 1260 wrote to memory of 3784	1260	a1c6ca6ac53767bb9d6895f18ba2e784.exe	88

C:\Users\Admin\AppData\Local\Temp\a1c6ca6ac53767bb9d6895f18ba2e784.exe
"C:\Users\Admin\AppData\Local\Temp\a1c6ca6ac53767bb9d6895f18ba2e784.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Users\Admin\AppData\Local\Temp\606F.tmp
  "C:\Users\Admin\AppData\Local\Temp\606F.tmp" --splashC:\Users\Admin\AppData\Local\Temp\a1c6ca6ac53767bb9d6895f18ba2e784.exe AD166ED0EDBFDAAED75C4296B97B1F7B30504C7083ED032D8DA216922791BDF34E1B6C10C2CE1132E1D7CEB50224D804E04AEE0A3EFEE21BBC9374F8A7996A0E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3784

C:\Users\Admin\AppData\Local\Temp\606F.tmp

Filesize
1.9MB

MD5
43af99f7755e28652a85a9394496d8a5

SHA1
535c26dd12d83f5c6127cb8f35f61b4d0ed42214

SHA256
41c47a2b43de02c1111fe12d2fea2df0e4a6f3f800f38d8ef1a8bac280369f3e

SHA512
ab077e28f8d6a8261aed56c2ffbd06a8f75b5c55c24614c1da92021c6c1f52032ff5e9af782c3ec648b7c798a3586d13ba3f1868a155e8812b5cc6e7d37aa62c

Download Submit
memory/1260-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/3784-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download