1f0362e7242fe446fa4d93941857b82135283b7bc7ae849bd08f2fc17e72247f

Analysis

max time kernel
115s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 06:33

Target

ab3b2d06b755844683a3c786c53e51d2.exe
Size

29KB
MD5

ab3b2d06b755844683a3c786c53e51d2
SHA1

a4e3044b4c481207d4aedd59f047b9fe600d2d21
SHA256

1f0362e7242fe446fa4d93941857b82135283b7bc7ae849bd08f2fc17e72247f
SHA512

8d91975f18eac5aeb0e26f0117851b7826f5efa2b1064cdc01089cf67d0b357f35c460a212e521bb3cb96be6e11471d0604828e3740042aec6d40c06fd1aeb1d
SSDEEP

768:UH9PxhMDzqiUJmaSb64ysgNBjxfZy7+wV:UHvjrJj/sgbjxxy7+g

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 2948	784	ab3b2d06b755844683a3c786c53e51d2.exe	96
PID 784 wrote to memory of 2948	784	ab3b2d06b755844683a3c786c53e51d2.exe	96
PID 784 wrote to memory of 2948	784	ab3b2d06b755844683a3c786c53e51d2.exe	96
PID 784 wrote to memory of 2808	784	ab3b2d06b755844683a3c786c53e51d2.exe	99
PID 784 wrote to memory of 2808	784	ab3b2d06b755844683a3c786c53e51d2.exe	99
PID 784 wrote to memory of 2808	784	ab3b2d06b755844683a3c786c53e51d2.exe	99

C:\Users\Admin\AppData\Local\Temp\ab3b2d06b755844683a3c786c53e51d2.exe
"C:\Users\Admin\AppData\Local\Temp\ab3b2d06b755844683a3c786c53e51d2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "c:\_uninsep.bat"
  2⤵
  PID:2948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "c:\_uninsep.bat"
  2⤵
  PID:2808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1292 --field-trial-handle=2588,i,4353937220825226770,7138584070663735671,262144 --variations-seed-version /prefetch:8
1⤵
PID:2248

\??\c:\_uninsep.bat

Filesize
182B

MD5
4e013d29be0acedd1559be1577896698

SHA1
41c6ff5d54a0237f34b1fba4b5aee7a2bbb426e0

SHA256
ecde6e840313b485244a7caccbbe454d3562c500d895878b9f354c5b9fb3746f

SHA512
cd033c1be61311826432c640e3cac2fa5d8f1f8e8fc9b635cceaf593f008d926a254778008953af405e9ae940c9fbea21ff3c3c62df9a31f9566407af62658e3

Download Submit
memory/784-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/784-4-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download