cc728fff77b36c89b2e410414a908f679b226defd1ff03ca9ceaa5fbf0b7437b

Analysis

max time kernel
161s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 23:26

Target

cc728fff77b36c89b2e410414a908f679b226defd1ff03ca9ceaa5fbf0b7437b.exe
Size

73KB
MD5

7ab1dd78de8c6989418cb7d016c0f714
SHA1

18e9604088617fe128b377524d9d70ddf7861eae
SHA256

cc728fff77b36c89b2e410414a908f679b226defd1ff03ca9ceaa5fbf0b7437b
SHA512

9d2cb5ec9b44fbbda49a90ef9a6b6c9865ebbe9ddbc36848f579d49571a6502330196d4aae1c0b1059f171306aa4ba04f8813ab22c4619c5759a04a0934b4114
SSDEEP

1536:hbt6TWFYUK5QPqfhVWbdsmA+RjPFLC+e5hA0ZGUGf2g:h5KRUNPqfcxA+HFshAOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3608	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 3176	1616	cc728fff77b36c89b2e410414a908f679b226defd1ff03ca9ceaa5fbf0b7437b.exe	96
PID 1616 wrote to memory of 3176	1616	cc728fff77b36c89b2e410414a908f679b226defd1ff03ca9ceaa5fbf0b7437b.exe	96
PID 1616 wrote to memory of 3176	1616	cc728fff77b36c89b2e410414a908f679b226defd1ff03ca9ceaa5fbf0b7437b.exe	96
PID 3176 wrote to memory of 3608	3176	cmd.exe	97
PID 3176 wrote to memory of 3608	3176	cmd.exe	97
PID 3176 wrote to memory of 3608	3176	cmd.exe	97
PID 3608 wrote to memory of 2912	3608	[email protected]	98
PID 3608 wrote to memory of 2912	3608	[email protected]	98
PID 3608 wrote to memory of 2912	3608	[email protected]	98

C:\Users\Admin\AppData\Local\Temp\cc728fff77b36c89b2e410414a908f679b226defd1ff03ca9ceaa5fbf0b7437b.exe
"C:\Users\Admin\AppData\Local\Temp\cc728fff77b36c89b2e410414a908f679b226defd1ff03ca9ceaa5fbf0b7437b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3176
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3608
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:2912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4148 --field-trial-handle=2272,i,1589057049575649654,2929151440327217574,262144 --variations-seed-version /prefetch:8
1⤵
PID:2940

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
7ce5fe1fb9255b2eab91272b334a331f

SHA1
ec8b356ae3ce1e6795249a230042f386042da7d8

SHA256
17617a64289ae8c37e959d3532fe7455c99276415d9659d35c2d464468fadf72

SHA512
dcdd68021ff75147679292356bc65b0f5f5f0f9a725bfb2d91a15df39a58b60f521267b14d44714e94718c62bbe3b21018ebbe30a3ec933103efd5f51e0290c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/1616-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/3608-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download