9102592a9a6e7b1be62dee53c8f4407e0961ff615653e574343378dc936dfd94

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-03-2024 21:06

Target

9102592a9a6e7b1be62dee53c8f4407e0961ff615653e574343378dc936dfd94.exe
Size

73KB
MD5

f6775b22ceb91ded1032cede7f82ea02
SHA1

47e640203f263433651a2255684ca23a7e435cbf
SHA256

9102592a9a6e7b1be62dee53c8f4407e0961ff615653e574343378dc936dfd94
SHA512

f0ca9922d0c999d29c80a2e0d7c2fdfcec375908b97f6a7a17651a02caec7cc77a3f7900dca7b2555977395425837d1f817a880be23bbb9389d3fde561e81b37
SSDEEP

1536:hbEyfBVLU6K5QPqfhVWbdsmA+RjPFLC+e5ha0ZGUGf2g:hA6NPqfcxA+HFshaOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4696	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 4528	4908	9102592a9a6e7b1be62dee53c8f4407e0961ff615653e574343378dc936dfd94.exe	89
PID 4908 wrote to memory of 4528	4908	9102592a9a6e7b1be62dee53c8f4407e0961ff615653e574343378dc936dfd94.exe	89
PID 4908 wrote to memory of 4528	4908	9102592a9a6e7b1be62dee53c8f4407e0961ff615653e574343378dc936dfd94.exe	89
PID 4528 wrote to memory of 4696	4528	cmd.exe	90
PID 4528 wrote to memory of 4696	4528	cmd.exe	90
PID 4528 wrote to memory of 4696	4528	cmd.exe	90
PID 4696 wrote to memory of 2916	4696	[email protected]	91
PID 4696 wrote to memory of 2916	4696	[email protected]	91
PID 4696 wrote to memory of 2916	4696	[email protected]	91

C:\Users\Admin\AppData\Local\Temp\9102592a9a6e7b1be62dee53c8f4407e0961ff615653e574343378dc936dfd94.exe
"C:\Users\Admin\AppData\Local\Temp\9102592a9a6e7b1be62dee53c8f4407e0961ff615653e574343378dc936dfd94.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4528
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4696
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:2916

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
69259801acc14f2f4488563e2f2277b8

SHA1
065af084f575658ea10555c5f3afca1d25f377ba

SHA256
3b972228db1c24e0925459995ed8b80fbe459fc400979371049a67175a4fc0e4

SHA512
914b242f9ed69fafe85f19cdaf0acf783a79df06d67e045facc89d6266f6d6abf338ae42dbe927ed56f330b5aca51e275984da223933c2c31692c6b72d343cf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/4696-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4908-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download