0a641ddac523ff443a8def5806793fcc88f9036cd6d47cd36da6b44ac871e9d3

Analysis

max time kernel
158s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 23:30

Target

bd16b24238dc39c73ec707c903fc1132.exe
Size

1.9MB
MD5

bd16b24238dc39c73ec707c903fc1132
SHA1

1f5d76c9de2653612607ce7bf8981124ea8ed494
SHA256

0a641ddac523ff443a8def5806793fcc88f9036cd6d47cd36da6b44ac871e9d3
SHA512

ea2768b59a0f9e91d755f10a39a87f214ac8449ecc841048d3800c6232fe03107d31c47f3df023b0efc9247c3d82c5fc20c23ba8ccd2bd8dc90cc5caadd0bcbb
SSDEEP

49152:Qoa1taC070djjaLPSVcKsuPz7nL+pB2Os05:Qoa1taC0wjqt8zbK2NO

Score

7^/10

Deletes itself 1 IoCs

pid	Process
928	77DB.tmp

Executes dropped EXE 1 IoCs

pid	Process
928	77DB.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 928	4020	bd16b24238dc39c73ec707c903fc1132.exe	99
PID 4020 wrote to memory of 928	4020	bd16b24238dc39c73ec707c903fc1132.exe	99
PID 4020 wrote to memory of 928	4020	bd16b24238dc39c73ec707c903fc1132.exe	99

C:\Users\Admin\AppData\Local\Temp\bd16b24238dc39c73ec707c903fc1132.exe
"C:\Users\Admin\AppData\Local\Temp\bd16b24238dc39c73ec707c903fc1132.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Users\Admin\AppData\Local\Temp\77DB.tmp
  "C:\Users\Admin\AppData\Local\Temp\77DB.tmp" --splashC:\Users\Admin\AppData\Local\Temp\bd16b24238dc39c73ec707c903fc1132.exe F6A64955F62ABC090CC84B7E6AE120EB514AA488CF23B3A7E89C8B7B14D83CEB503177608E4EED02A496C13961AD321F742D2FDEC4A503CCB14D5FA06486ED81
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3692 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:4596

C:\Users\Admin\AppData\Local\Temp\77DB.tmp

Filesize
1.9MB

MD5
05a4e0ab9c1b219a4a28e49cdca07776

SHA1
99ec8f2abdeb8aab5800f6c09f43d33ce86a5a30

SHA256
9ca441131e4881c85a4aca77b561366978a80b05c4af9df7629a859ca82f4489

SHA512
a04998e8b333b4c5b248c7bbf2164504860379edea243a7f97d4fbac20b34087f58bcf8164d94523b7c49df077cf831423841fea19cbd09e7d77fb4b7bf97df7

Download Submit
memory/928-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4020-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download