7f1d176658b335282a3758b742158b7bfab8d150cb6eddbba365ed528da41022

Analysis

max time kernel
144s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 07:40

Target

ab5cf8ba37460fb3c0d808f78f80bdb6.exe
Size

1.9MB
MD5

ab5cf8ba37460fb3c0d808f78f80bdb6
SHA1

8c168915d5593eab2a7f95ea1d5a07195076120a
SHA256

7f1d176658b335282a3758b742158b7bfab8d150cb6eddbba365ed528da41022
SHA512

abeef144ee12b034d3492956f665d0749c05c64d8bda5ef93f9a596dbff63547c97e7287b8f45c905e8c0935027f09b9815ea7f5aa7bcb4dcdd6bddaf200da32
SSDEEP

49152:Qoa1taC070d9LD2gkRlX80JIC2d3afk0GZ:Qoa1taC0IH2gSs6ICW3mGZ

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2160	7D0F.tmp

Executes dropped EXE 1 IoCs

pid	Process
2160	7D0F.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 2160	1588	ab5cf8ba37460fb3c0d808f78f80bdb6.exe	89
PID 1588 wrote to memory of 2160	1588	ab5cf8ba37460fb3c0d808f78f80bdb6.exe	89
PID 1588 wrote to memory of 2160	1588	ab5cf8ba37460fb3c0d808f78f80bdb6.exe	89

C:\Users\Admin\AppData\Local\Temp\ab5cf8ba37460fb3c0d808f78f80bdb6.exe
"C:\Users\Admin\AppData\Local\Temp\ab5cf8ba37460fb3c0d808f78f80bdb6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Users\Admin\AppData\Local\Temp\7D0F.tmp
  "C:\Users\Admin\AppData\Local\Temp\7D0F.tmp" --splashC:\Users\Admin\AppData\Local\Temp\ab5cf8ba37460fb3c0d808f78f80bdb6.exe 3CC3B897DEFE3816C469A7B925EA8A7F63EDDF089B44C5096CEB8FCC3157C154BCE8F51AAE4B87CE20E679382F77471200452446DEFE087D5FB352113441B5A8
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2160

C:\Users\Admin\AppData\Local\Temp\7D0F.tmp

Filesize
1.9MB

MD5
504408062a5c8b71f4c9e1ac13551630

SHA1
6fc702ed678562febc3908fa6a5012375ebf6d2c

SHA256
1a996c7a83456018d1d8ddb9d06bee08367009c4dea70cd25847975522c7a983

SHA512
31b5795e5b0e4b45f23ff197e59dfd3acdff2330d061e252ca38925d29b55205b5e8b7e4cb3b598de31fd029a34c4507c2bc6f1b379a14314de7c7e86cd4f999

Download Submit
memory/1588-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/2160-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download