bffc4614c81fd363048b5280ef3afd69a5391ee2524b8933c830c5f18a2db99e

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-03-2024 22:50

Target

bffc4614c81fd363048b5280ef3afd69a5391ee2524b8933c830c5f18a2db99e.exe
Size

955KB
MD5

fa86cdc4154576099f9936fdb3484754
SHA1

11e360b6e5cfbb305bce459ab9948d325c67dfa1
SHA256

bffc4614c81fd363048b5280ef3afd69a5391ee2524b8933c830c5f18a2db99e
SHA512

27aa4e294d7424dc81e320e9a10be006004b92d083c011766c43dad9042fa540f5878c0c760f0c5ea7dd6caabbeb5aa68ee6901e4ae524616442f88e86babb93
SSDEEP

24576:oTEc1b+PONfuDNmWs9kLZmX1+RnM3L2N9Y3G3wSK6JE4t6FGerrthf:oTEpPDNmWsuZmF+RnM3L2N9YWgSK6JEb

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4832	6457.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 464 wrote to memory of 4832	464	bffc4614c81fd363048b5280ef3afd69a5391ee2524b8933c830c5f18a2db99e.exe	89
PID 464 wrote to memory of 4832	464	bffc4614c81fd363048b5280ef3afd69a5391ee2524b8933c830c5f18a2db99e.exe	89
PID 464 wrote to memory of 4832	464	bffc4614c81fd363048b5280ef3afd69a5391ee2524b8933c830c5f18a2db99e.exe	89

C:\Users\Admin\AppData\Local\Temp\bffc4614c81fd363048b5280ef3afd69a5391ee2524b8933c830c5f18a2db99e.exe
"C:\Users\Admin\AppData\Local\Temp\bffc4614c81fd363048b5280ef3afd69a5391ee2524b8933c830c5f18a2db99e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:464
- C:\Users\Admin\AppData\Local\Temp\6457.tmp
  "C:\Users\Admin\AppData\Local\Temp\6457.tmp"
  2⤵
  - Executes dropped EXE
  PID:4832

C:\Users\Admin\AppData\Local\Temp\6457.tmp

Filesize
955KB

MD5
70f77016a5fa57e3556070e24177faa6

SHA1
c14404484d8121a846cf80138d9211e3c94941c7

SHA256
09e729693d3ba1d4d7224bc396128995f6457cda228889f07cdac7e885435221

SHA512
c6c50e3106307105520ac278e0505327224f513f18aab3889242c9d32e13d3d9aceb58224953e673e565ef52cc96aedfed1fd02f151bf0fab4ea18857c7e5516

Download Submit