699e5d15c15a2c16c7cff9c0baca7408920bce0ae1a616d2e92d3cde6f7e1d76

Analysis

max time kernel
145s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 21:28

Target

699e5d15c15a2c16c7cff9c0baca7408920bce0ae1a616d2e92d3cde6f7e1d76.exe
Size

79KB
MD5

07332dcaa3ed6114afc982db215a802c
SHA1

9eb28e4478186e552e3ea14fa394364d9cb16519
SHA256

699e5d15c15a2c16c7cff9c0baca7408920bce0ae1a616d2e92d3cde6f7e1d76
SHA512

47312143378e25ac4122a2d81face36249b37c35e9fe0a436bfce6afd93c968435b7aefd985aa25d6986eb686b2339a6c73d7d373e6f6bc7fa849dee15dec62b
SSDEEP

1536:zvv2Nv/WQmsfWxOQA8AkqUhMb2nuy5wgIP0CSJ+5yiB8GMGlZ5G:zveNv/WQ9fNGdqU7uy5w9WMyiN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4416	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 3592	2676	699e5d15c15a2c16c7cff9c0baca7408920bce0ae1a616d2e92d3cde6f7e1d76.exe	89
PID 2676 wrote to memory of 3592	2676	699e5d15c15a2c16c7cff9c0baca7408920bce0ae1a616d2e92d3cde6f7e1d76.exe	89
PID 2676 wrote to memory of 3592	2676	699e5d15c15a2c16c7cff9c0baca7408920bce0ae1a616d2e92d3cde6f7e1d76.exe	89
PID 3592 wrote to memory of 4416	3592	cmd.exe	90
PID 3592 wrote to memory of 4416	3592	cmd.exe	90
PID 3592 wrote to memory of 4416	3592	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\699e5d15c15a2c16c7cff9c0baca7408920bce0ae1a616d2e92d3cde6f7e1d76.exe
"C:\Users\Admin\AppData\Local\Temp\699e5d15c15a2c16c7cff9c0baca7408920bce0ae1a616d2e92d3cde6f7e1d76.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3592
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:4416

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
a60f69f1deee44ad510cf4bfb5f33944

SHA1
6f5688614385f91c34f157e673958b61ecd59922

SHA256
76076039b7e61da818d516b88371f297ccaecc57ce65d9b95f8d7c5e54bbc3a5

SHA512
7aeea6276652524670418257682b2046dd3a68b839a9c7a49124d4e03ada40e2dda0626d999236ed832ca1cc702021a9931c2d7dc4fede7eff562d9b844236d4

Download Submit
memory/2676-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4416-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download