a02408e7fdcfb06e253388d4b2698c200e3a16a8278183dafe47fe638fb787ee

Analysis

max time kernel
96s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 21:34

Target

a02408e7fdcfb06e253388d4b2698c200e3a16a8278183dafe47fe638fb787ee.exe
Size

73KB
MD5

c54181aab1a2fe0fc4d1035a81f21597
SHA1

f07695831b6e973359a71d1827e0554590bfc298
SHA256

a02408e7fdcfb06e253388d4b2698c200e3a16a8278183dafe47fe638fb787ee
SHA512

ef7fbafb12e3dce81b76ab53bd80e535bb8ae3bdf0b9087837b2c6705cc888f901ef51adf7dc81e93a6c73905968e0b35e8d4c619aee167e3b85d53643cd7320
SSDEEP

1536:hb/uojkcN6Lb/J5RhwK5QPqfhVWbdsmA+RjPFLC+e5hg0ZGUGf2g:hDuojk7MNPqfcxA+HFshgOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2824	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 4856	4160	a02408e7fdcfb06e253388d4b2698c200e3a16a8278183dafe47fe638fb787ee.exe	86
PID 4160 wrote to memory of 4856	4160	a02408e7fdcfb06e253388d4b2698c200e3a16a8278183dafe47fe638fb787ee.exe	86
PID 4160 wrote to memory of 4856	4160	a02408e7fdcfb06e253388d4b2698c200e3a16a8278183dafe47fe638fb787ee.exe	86
PID 4856 wrote to memory of 2824	4856	cmd.exe	87
PID 4856 wrote to memory of 2824	4856	cmd.exe	87
PID 4856 wrote to memory of 2824	4856	cmd.exe	87
PID 2824 wrote to memory of 2420	2824	[email protected]	88
PID 2824 wrote to memory of 2420	2824	[email protected]	88
PID 2824 wrote to memory of 2420	2824	[email protected]	88

C:\Users\Admin\AppData\Local\Temp\a02408e7fdcfb06e253388d4b2698c200e3a16a8278183dafe47fe638fb787ee.exe
"C:\Users\Admin\AppData\Local\Temp\a02408e7fdcfb06e253388d4b2698c200e3a16a8278183dafe47fe638fb787ee.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2824
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 15225.exe
      4⤵
      PID:2420

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
1102ed868651f3bbc9843a942c68406b

SHA1
d8e659f11f681a557ad875e3b845fac7b3d7be3e

SHA256
e37a226b665edb953908ccba0248486bcfad3ccb81ea2c5ea0efa27de3cc36ae

SHA512
32552f7fe905c5f0c9c2584bdf372566aaa10640cde0f2e67a7887930e4ff8cd0952d5b3e949b6a722bbdbe44e38f9c8fa691f7c272f35a803f1cc7e05ee939c

Download Submit
C:\Users\Admin\AppData\Local\Temp\15225.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/2824-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4160-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download