ce905f3112692bf9bd38ba9faac0f9ad80106cc1fa17801f51a82607ed3229f7

Analysis

max time kernel
164s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 02:18

Target

ce905f3112692bf9bd38ba9faac0f9ad80106cc1fa17801f51a82607ed3229f7.exe
Size

79KB
MD5

072a6453d13a52c8cb8f3cae276e163b
SHA1

229bfff0c95d72129e6fe935ca3c961f5df76a52
SHA256

ce905f3112692bf9bd38ba9faac0f9ad80106cc1fa17801f51a82607ed3229f7
SHA512

ca7075fdea86aaa3c9159afb8d539adc048755329d7efe7ab13f0ca8acb335cea1e82d3fe7b33314ee45f6f9ebabaf9ddc3421621626df300f2e48f146014e77
SSDEEP

1536:zvMWqzr6NpAOQA8AkqUhMb2nuy5wgIP0CSJ+5yAB8GMGlZ5G:zvMtzrEGdqU7uy5w9WMyAN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3564	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4424 wrote to memory of 1100	4424	ce905f3112692bf9bd38ba9faac0f9ad80106cc1fa17801f51a82607ed3229f7.exe	90
PID 4424 wrote to memory of 1100	4424	ce905f3112692bf9bd38ba9faac0f9ad80106cc1fa17801f51a82607ed3229f7.exe	90
PID 4424 wrote to memory of 1100	4424	ce905f3112692bf9bd38ba9faac0f9ad80106cc1fa17801f51a82607ed3229f7.exe	90
PID 1100 wrote to memory of 3564	1100	cmd.exe	92
PID 1100 wrote to memory of 3564	1100	cmd.exe	92
PID 1100 wrote to memory of 3564	1100	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\ce905f3112692bf9bd38ba9faac0f9ad80106cc1fa17801f51a82607ed3229f7.exe
"C:\Users\Admin\AppData\Local\Temp\ce905f3112692bf9bd38ba9faac0f9ad80106cc1fa17801f51a82607ed3229f7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:3564

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
7cb1f3ab971f016235d70616f9cab899

SHA1
6a58ca52b723c46debae05aacd9ea7f8a57d6fa5

SHA256
b06018a2a206d4f5ef14745591a725c8eb336788b3c5b508486bbe5ef2bf1934

SHA512
8e18332508128676647e06d6fc48b659dee12d0869f1e715713c2c4febeb9e3e66df88301244e7b965cf8ddaa91bd0c31f145d0c679aa8238db26d5d4dd91210

Download Submit
memory/3564-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4424-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download