ceedeb1ca2f0aeb05757a562d09d4d5f684692c295d88dae90eabc348d49e9e3

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-03-2024 23:33

Target

ceedeb1ca2f0aeb05757a562d09d4d5f684692c295d88dae90eabc348d49e9e3.exe
Size

4.1MB
MD5

a78224be9b79b084746a445b94fa263e
SHA1

c6f53d66e6d235593a5509efce0e42353a35f4f4
SHA256

ceedeb1ca2f0aeb05757a562d09d4d5f684692c295d88dae90eabc348d49e9e3
SHA512

c3ef99e495e466da5bf699b2302df80fe84d73759f36933d521de5690577212798a44ee191202a46cc33f3ceebe06d13d8e47f88602310c95e4f64dddaeea6ef
SSDEEP

49152:1iCrJIy7TTO/Pd+gsMyBzsHrQNQ84g7NDXcNPqPsdkjCVBYZ37SZYtgJCr0EboRV:1iTy7WfyBgMlZxQ56PCV6Z3OZYtMA3Y

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1252	ceedeb1ca2f0aeb05757a562d09d4d5f684692c295d88dae90eabc348d49e9e3.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 1252	3880	ceedeb1ca2f0aeb05757a562d09d4d5f684692c295d88dae90eabc348d49e9e3.exe	98
PID 3880 wrote to memory of 1252	3880	ceedeb1ca2f0aeb05757a562d09d4d5f684692c295d88dae90eabc348d49e9e3.exe	98
PID 3880 wrote to memory of 1252	3880	ceedeb1ca2f0aeb05757a562d09d4d5f684692c295d88dae90eabc348d49e9e3.exe	98

C:\Users\Admin\AppData\Local\Temp\ceedeb1ca2f0aeb05757a562d09d4d5f684692c295d88dae90eabc348d49e9e3.exe
"C:\Users\Admin\AppData\Local\Temp\ceedeb1ca2f0aeb05757a562d09d4d5f684692c295d88dae90eabc348d49e9e3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Users\Admin\AppData\Local\Temp\is-9U5VJ.tmp\ceedeb1ca2f0aeb05757a562d09d4d5f684692c295d88dae90eabc348d49e9e3.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-9U5VJ.tmp\ceedeb1ca2f0aeb05757a562d09d4d5f684692c295d88dae90eabc348d49e9e3.tmp" /SL5="$D01C4,3410312,781824,C:\Users\Admin\AppData\Local\Temp\ceedeb1ca2f0aeb05757a562d09d4d5f684692c295d88dae90eabc348d49e9e3.exe"
  2⤵
  - Executes dropped EXE
  PID:1252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4172 --field-trial-handle=2588,i,14229658658073991926,6938034815163866135,262144 --variations-seed-version /prefetch:8
1⤵
PID:4960

C:\Users\Admin\AppData\Local\Temp\is-9U5VJ.tmp\ceedeb1ca2f0aeb05757a562d09d4d5f684692c295d88dae90eabc348d49e9e3.tmp

Filesize
3.0MB

MD5
699db7ace1cebc7a891b18b08a9b29ab

SHA1
e45eae88b2f6fb8df78a8c9be3ec509bd129321b

SHA256
491c177840fb976c13c429872f75804602c7461c5c69fc358a7289df1f8a426e

SHA512
8252f8c04e90c3d15478f3525151857d55aabe9614d48b4815d4afc79225fcbd9c10e01f26a51bb2a0eb1ca49df0ca841a0d01691251271071724bccf5f78535

Download Submit
memory/1252-5-0x0000000000930000-0x0000000000931000-memory.dmp

Filesize
4KB

Download
memory/1252-8-0x0000000000400000-0x000000000070A000-memory.dmp

Filesize
3.0MB

Download
memory/1252-11-0x0000000000930000-0x0000000000931000-memory.dmp

Filesize
4KB

Download
memory/3880-0-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3880-7-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download