7d1a235fd40a903232526dd727a6ce14102c7fbe94d8e656b0d43b6d54e34627

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 12:29

Target

bb4396da7a552d3f59dbad47d3cbf2d8.exe
Size

429KB
MD5

bb4396da7a552d3f59dbad47d3cbf2d8
SHA1

3a981dd1383cc91f2f072cc337a9e742a0ea4684
SHA256

7d1a235fd40a903232526dd727a6ce14102c7fbe94d8e656b0d43b6d54e34627
SHA512

b6d7c8077510b069aaa605888f0c2631063ce15f9262ac093b322eaa3d07049ad0054589956726e374df3ae68c8f128dd55a41b324b7c13e7b370496a474f5e4
SSDEEP

6144:4BdS0xk6e96C2U/2aqg9JBP/pFfbGgEkWqqxEKC+RQKXcy2A:4B4lzAKpfplqrRrXVl

Score

1^/10

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
5012	bb4396da7a552d3f59dbad47d3cbf2d8.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 1104	5012	bb4396da7a552d3f59dbad47d3cbf2d8.exe	90
PID 5012 wrote to memory of 1104	5012	bb4396da7a552d3f59dbad47d3cbf2d8.exe	90
PID 5012 wrote to memory of 1104	5012	bb4396da7a552d3f59dbad47d3cbf2d8.exe	90

C:\Users\Admin\AppData\Local\Temp\bb4396da7a552d3f59dbad47d3cbf2d8.exe
"C:\Users\Admin\AppData\Local\Temp\bb4396da7a552d3f59dbad47d3cbf2d8.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Users\Admin\AppData\Local\Temp\bb4396da7a552d3f59dbad47d3cbf2d8.exe
  "C:\Users\Admin\AppData\Local\Temp\bb4396da7a552d3f59dbad47d3cbf2d8.exe"
  2⤵
  PID:1104

memory/5012-1-0x0000000000E00000-0x0000000000F00000-memory.dmp

Filesize
1024KB

Download
memory/5012-2-0x0000000001270000-0x0000000001274000-memory.dmp

Filesize
16KB

Download