97880d5ab210fdf944a9409db9536fec2fb01b427ba21da3ae72887f71948b05

Analysis

max time kernel
142s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-02-2024 05:24

Target

ab1aaca16e9f584a849e53c522c1948a.exe
Size

580KB
MD5

ab1aaca16e9f584a849e53c522c1948a
SHA1

cbe18b89619fa684b0e884a1461c1ea83d010eb1
SHA256

97880d5ab210fdf944a9409db9536fec2fb01b427ba21da3ae72887f71948b05
SHA512

898fb3ad4500c6f56ceb95fc58cc1df4cd565f3dc1c742ca778dc69717e958d1de9e945886977754fa508044e80ab574f011b3f7e86606533b9e626879514fd2
SSDEEP

12288:MLry/neyx7f/A64j7PV/F2VC+QyHDaiyJ2WvyiRPsb1OrN:qKeyxTAJj7PV/s4k+oW6itSOrN

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1444	mmuqhtatqtaf.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\xxbjrg\mmuqhtatqtaf.exe	ab1aaca16e9f584a849e53c522c1948a.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 1444	3976	ab1aaca16e9f584a849e53c522c1948a.exe	96
PID 3976 wrote to memory of 1444	3976	ab1aaca16e9f584a849e53c522c1948a.exe	96
PID 3976 wrote to memory of 1444	3976	ab1aaca16e9f584a849e53c522c1948a.exe	96

C:\Users\Admin\AppData\Local\Temp\ab1aaca16e9f584a849e53c522c1948a.exe
"C:\Users\Admin\AppData\Local\Temp\ab1aaca16e9f584a849e53c522c1948a.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Program Files (x86)\xxbjrg\mmuqhtatqtaf.exe
  "C:\Program Files (x86)\xxbjrg\mmuqhtatqtaf.exe"
  2⤵
  - Executes dropped EXE
  PID:1444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:4912

C:\Program Files (x86)\xxbjrg\mmuqhtatqtaf.exe

Filesize
606KB

MD5
1dee4d43ded01881571a533cb8390e5f

SHA1
1eeeeb87e86cbac697d284897ca8b9db5f4937bd

SHA256
c9643c320b7926fb8c7f3867a3d5c1bec870c727a109a8e1815547dda6445389

SHA512
84bf5a9e00e42e255cfad605b875684a4fe3e0fba792ac19e38171ff1af07936ea8e5f6ff7ec7b49b5e9dbfc8cceba97529a2e0b93cb302fc26636d6f8c541f1

Download Submit
memory/1444-7-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1444-8-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/3976-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/3976-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/3976-6-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download