8219bc6bf913d422d4c5d1086be1ab4c1dfbcad8ea2c403289ba83f40218dd54

Analysis

max time kernel
114s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 04:33

Target

ab031f02acd5eb8a2af9653d5ee4b095.exe
Size

1.9MB
MD5

ab031f02acd5eb8a2af9653d5ee4b095
SHA1

a3d0d1a5d3f72b56a72a47e8ac5e7512c18f4fb2
SHA256

8219bc6bf913d422d4c5d1086be1ab4c1dfbcad8ea2c403289ba83f40218dd54
SHA512

185be6e460b0e7edb4c56aa97e16fd9668119a187299301722699682c6ca5243dadc3781c42c467e3d64810d473aeef890376f44cc311d6f510cddccab51d881
SSDEEP

49152:Qoa1taC070dBjzDFt16JSbjdCCxykNgoppmiu:Qoa1taC0Gjzpj6obpCfkNZ+7

Score

7^/10

Deletes itself 1 IoCs

pid	Process
5004	6EA8.tmp

Executes dropped EXE 1 IoCs

pid	Process
5004	6EA8.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 5004	636	ab031f02acd5eb8a2af9653d5ee4b095.exe	98
PID 636 wrote to memory of 5004	636	ab031f02acd5eb8a2af9653d5ee4b095.exe	98
PID 636 wrote to memory of 5004	636	ab031f02acd5eb8a2af9653d5ee4b095.exe	98

C:\Users\Admin\AppData\Local\Temp\ab031f02acd5eb8a2af9653d5ee4b095.exe
"C:\Users\Admin\AppData\Local\Temp\ab031f02acd5eb8a2af9653d5ee4b095.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:636
- C:\Users\Admin\AppData\Local\Temp\6EA8.tmp
  "C:\Users\Admin\AppData\Local\Temp\6EA8.tmp" --splashC:\Users\Admin\AppData\Local\Temp\ab031f02acd5eb8a2af9653d5ee4b095.exe 428B014D36C2BD2023AB8268F46BDDDE5BB2BE456C7A0B67CD43C2201F3162E4F581BF3C9DA72A633E5D6935B22A38599FA171C73249187203E14D5921666653
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:5004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1032 --field-trial-handle=2256,i,9172343514068348080,519219714517961765,262144 --variations-seed-version /prefetch:8
1⤵
PID:1908

C:\Users\Admin\AppData\Local\Temp\6EA8.tmp

Filesize
1.9MB

MD5
7c04915245e001a82254758bf68220fc

SHA1
8971fc34d8d350a44f85ec01e7d1affff55fcaf0

SHA256
c3786f560c5b85782985c61af541c282a0bd7412abb84e00fe75a8c370aaaf83

SHA512
88137679fefb350bfde449f8fdfd9d4e6bfc76eb681b4499eb35abad4311de8adaae4dab4bc9cd3eab64edaca1d9bbdf3eba91d82cbf8f33b5778b03576394bf

Download Submit
memory/636-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/5004-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download