90cc1f227e008515f78a2f057f0569a04c6ebae69474ee2f26c057078c48779d

Analysis

max time kernel
91s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 00:03

Target

90cc1f227e008515f78a2f057f0569a04c6ebae69474ee2f26c057078c48779d.exe
Size

73KB
MD5

8110775f52b855290b0a9207899fda17
SHA1

24e3090532b8e091e0fed048010b3ffbed5a28ce
SHA256

90cc1f227e008515f78a2f057f0569a04c6ebae69474ee2f26c057078c48779d
SHA512

6b698fe034374f9ebd0d5bba7efc73f439bab75eddbf840629face9da7dd0d2698ffa7d9f68da5434cf79a9a219be385cc1c819972bbe51c47b60ee954dce816
SSDEEP

1536:hblJihw6Fovqos7K5QPqfhVWbdsmA+RjPFLC+e5hNT0ZGUGf2g:h76S9s7NPqfcxA+HFshFOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4280	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 4152	2144	90cc1f227e008515f78a2f057f0569a04c6ebae69474ee2f26c057078c48779d.exe	86
PID 2144 wrote to memory of 4152	2144	90cc1f227e008515f78a2f057f0569a04c6ebae69474ee2f26c057078c48779d.exe	86
PID 2144 wrote to memory of 4152	2144	90cc1f227e008515f78a2f057f0569a04c6ebae69474ee2f26c057078c48779d.exe	86
PID 4152 wrote to memory of 4280	4152	cmd.exe	87
PID 4152 wrote to memory of 4280	4152	cmd.exe	87
PID 4152 wrote to memory of 4280	4152	cmd.exe	87
PID 4280 wrote to memory of 3212	4280	[email protected]	88
PID 4280 wrote to memory of 3212	4280	[email protected]	88
PID 4280 wrote to memory of 3212	4280	[email protected]	88

C:\Users\Admin\AppData\Local\Temp\90cc1f227e008515f78a2f057f0569a04c6ebae69474ee2f26c057078c48779d.exe
"C:\Users\Admin\AppData\Local\Temp\90cc1f227e008515f78a2f057f0569a04c6ebae69474ee2f26c057078c48779d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4280
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:3212

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
423448d9782bf0cefc50248f34f2818f

SHA1
656cdbfa6e1837bd1f59abe62013821a6571d355

SHA256
6b41fed56e862f7cc97a739bb0e8ec2c7be362bf55724120551e42cca7950568

SHA512
0555b73c552ab099d604ea3adc72822de5ce5417487ff2af8fc17eacb03fd51ea0ee0af5a195d506a6cdd1c8454a456cfdcd8eaad67213325ff5484bc7d0ace4

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/2144-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4280-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download