98be6ab3a123a02eed434b9f36ce31e9e333172b93b3826ef12b0b40148e77a0

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2024, 15:10

Target

b5006cc6d6c38f6e761eca5fb9e9887f.exe
Size

1.9MB
MD5

b5006cc6d6c38f6e761eca5fb9e9887f
SHA1

69e66913b3543898b559aecc75bffcec14e84d22
SHA256

98be6ab3a123a02eed434b9f36ce31e9e333172b93b3826ef12b0b40148e77a0
SHA512

b56ea5456337b8aa735258c3ed064a9504863ec1bb1aa5dc4515c6de6053b5bb6083ac891294d8996101cf7811d3f1cf7fa8707f3780eef20e4b240df7b3d14e
SSDEEP

49152:Qoa1taC070dh/jV9Yzu263F5txwPeVOIs9:Qoa1taC0IjVx26VHeWVc9

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3276	47E6.tmp

Executes dropped EXE 1 IoCs

pid	Process
3276	47E6.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 3276	2044	b5006cc6d6c38f6e761eca5fb9e9887f.exe	92
PID 2044 wrote to memory of 3276	2044	b5006cc6d6c38f6e761eca5fb9e9887f.exe	92
PID 2044 wrote to memory of 3276	2044	b5006cc6d6c38f6e761eca5fb9e9887f.exe	92

C:\Users\Admin\AppData\Local\Temp\b5006cc6d6c38f6e761eca5fb9e9887f.exe
"C:\Users\Admin\AppData\Local\Temp\b5006cc6d6c38f6e761eca5fb9e9887f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Users\Admin\AppData\Local\Temp\47E6.tmp
  "C:\Users\Admin\AppData\Local\Temp\47E6.tmp" --splashC:\Users\Admin\AppData\Local\Temp\b5006cc6d6c38f6e761eca5fb9e9887f.exe 6410B4E9A89F1F85B8AF837B3827A7F3DE044D134B0F596325DB7EFC4C745EADFBC441283092B48C5E48281D4EDC698A5BA8683E939B85910A34CE92D89C5F58
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3276

C:\Users\Admin\AppData\Local\Temp\47E6.tmp

Filesize
1024KB

MD5
b6c3f54aa7f6eb204c4ccfd2b965829f

SHA1
0eeb3258881ebf9ab6ca72713ab782b983d4805d

SHA256
7b583c3bd02274895d7472c62059f53f0e4533d54df540f74e1166a7526a5661

SHA512
4d346d421326b34b59a6f47b1f1c781ffd43085722bacdbe32f33e4ad4f58e7a0d7389be0c838629f278d3aba67916f7abf2850adb668d3dfe75fcb66b6e56f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\47E6.tmp

Filesize
628KB

MD5
fceb1d9868943b01b9e22811e62edd74

SHA1
0a57e8746d71603fb8398548a41da4b9ae6d2149

SHA256
e8d630d106a28d449e3810f410cea4f8c9ff885c3097a49d2e9c2e6e544edfec

SHA512
75e894cb99a6f50b5ca8d7e5985773d534698b590319ce604883af219548c55c556c2dde61ad2525390d1f1cd851b84ea7cb653a5280d441a8edeed231af8eec

Download Submit
memory/2044-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/3276-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download