004d9b3456137fee326f5fb15dbe59c4f08da36590f05a1f2b0dd57f148f1cce

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 18:33

Target

004d9b3456137fee326f5fb15dbe59c4f08da36590f05a1f2b0dd57f148f1cce.exe
Size

73KB
MD5

af6a8908b6a73d34a56bed9d479c894b
SHA1

ecebbee3b694633645d84099bff439992ec40353
SHA256

004d9b3456137fee326f5fb15dbe59c4f08da36590f05a1f2b0dd57f148f1cce
SHA512

3776cb4e8b1825cab43cdd9fe5bb51bf3d8f286bf28a56638614984d1e6463df745568b731dc30c1cf051556b5b2b36ebb03d5d7a237eea7ec6b40a9482626cb
SSDEEP

1536:hbkaWqFWZmj2aZK5QPqfhVWbdsmA+RjPFLC+e5h4P0ZGUGf2g:hwa5XCONPqfcxA+HFsh4POg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3336	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2696	3040	004d9b3456137fee326f5fb15dbe59c4f08da36590f05a1f2b0dd57f148f1cce.exe	87
PID 3040 wrote to memory of 2696	3040	004d9b3456137fee326f5fb15dbe59c4f08da36590f05a1f2b0dd57f148f1cce.exe	87
PID 3040 wrote to memory of 2696	3040	004d9b3456137fee326f5fb15dbe59c4f08da36590f05a1f2b0dd57f148f1cce.exe	87
PID 2696 wrote to memory of 3336	2696	cmd.exe	89
PID 2696 wrote to memory of 3336	2696	cmd.exe	89
PID 2696 wrote to memory of 3336	2696	cmd.exe	89
PID 3336 wrote to memory of 4372	3336	[email protected]	90
PID 3336 wrote to memory of 4372	3336	[email protected]	90
PID 3336 wrote to memory of 4372	3336	[email protected]	90

C:\Users\Admin\AppData\Local\Temp\004d9b3456137fee326f5fb15dbe59c4f08da36590f05a1f2b0dd57f148f1cce.exe
"C:\Users\Admin\AppData\Local\Temp\004d9b3456137fee326f5fb15dbe59c4f08da36590f05a1f2b0dd57f148f1cce.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3336
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:4372

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
84285d60ced070cf799a661c280c8bd3

SHA1
0299b7cafb4b18868883de9ee1104411b5e4a66b

SHA256
ea8886af748edc95a9f60e76bd4b1680253e7b9ef080460132b9c57438ac692b

SHA512
29966aac93bf0cc5cfb2f530c31dd31be01533f042d9cd30a4a177aa0565d0cdefc9ec688b4211fd48858d0e0a020f6d63326d173385f9ff841e6e71a6ef2875

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/3040-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/3336-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download