7f5cf81eaf80d7797030a54c45b177c0751f404a01da5626c4c4efc7f04617bc

Analysis

max time kernel
164s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 22:17

Target

b9cb7d58e5d8b465d51ff7f216bd9700.exe
Size

1.9MB
MD5

b9cb7d58e5d8b465d51ff7f216bd9700
SHA1

875ae365a641e467c2c774e681f95b5adf065b3d
SHA256

7f5cf81eaf80d7797030a54c45b177c0751f404a01da5626c4c4efc7f04617bc
SHA512

296f0d7ae16afc48c571bf0228b838d42fd95317b947e0ff3d1b396325f330236445b137981116f52e910a2e1d7370623d2ccfefaad76e9c098427a2c1e12cf6
SSDEEP

49152:Qoa1taC070dwi/chagmnsA2lWGgr1pUhqWBsWGRh5:Qoa1taC0r+fN2lWGgrFNWGRr

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1844	C1F8.tmp

Executes dropped EXE 1 IoCs

pid	Process
1844	C1F8.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 1844	4880	b9cb7d58e5d8b465d51ff7f216bd9700.exe	90
PID 4880 wrote to memory of 1844	4880	b9cb7d58e5d8b465d51ff7f216bd9700.exe	90
PID 4880 wrote to memory of 1844	4880	b9cb7d58e5d8b465d51ff7f216bd9700.exe	90

C:\Users\Admin\AppData\Local\Temp\b9cb7d58e5d8b465d51ff7f216bd9700.exe
"C:\Users\Admin\AppData\Local\Temp\b9cb7d58e5d8b465d51ff7f216bd9700.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Users\Admin\AppData\Local\Temp\C1F8.tmp
  "C:\Users\Admin\AppData\Local\Temp\C1F8.tmp" --splashC:\Users\Admin\AppData\Local\Temp\b9cb7d58e5d8b465d51ff7f216bd9700.exe D205706A43B0C757A51D8021347C02FB553A6CF221F5BA5E934479AC698E8E552226CE708645A50AD822B21C6F6D756C1F647F88AD5066A64C5E3B4B71D1B98C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1844

C:\Users\Admin\AppData\Local\Temp\C1F8.tmp

Filesize
1.5MB

MD5
e8604f23a601380623f494fc0c80b0af

SHA1
8b2ab365a5d5c468eb9a8613e92c8da3ca223106

SHA256
e0fc81e1c3029d0af024cab74da1dcedd18ec4a48904291e7d91e6fa7718b886

SHA512
0d150dfb256710aa9296631f5f3d26962528701c0ccb1d8fbe1dca1f6571576e6345f408f41ff008a2b70cf59d0a035d6756d8616fa46f64bde01e036bf4400b

Download Submit
C:\Users\Admin\AppData\Local\Temp\C1F8.tmp

Filesize
470KB

MD5
23329a83601358ee6eb507e80eea8597

SHA1
696fbad53cda9a4ebe2f8e7c28353e699ac4d1ee

SHA256
d16501d9d68f8f065a953443a83a3e37cb0f1156b3d69d645a11054daa4505fd

SHA512
60faab77663549214f47aeef88972a7ce25756fa3eb70f2817f7dd56045883f2a4c15f3bba6c8837bc44c543f96a620ddcd53222ce73da60d4c0427019cdda0b

Download Submit
memory/1844-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4880-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download