b76ee072028c1cd05806db20a4f215c90c62e18cbbc74e3de24e1ea4854c041d

Analysis

max time kernel
156s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 00:11

Target

b76ee072028c1cd05806db20a4f215c90c62e18cbbc74e3de24e1ea4854c041d.exe
Size

73KB
MD5

9a866a331aa895d781a5cd1c8938ae3d
SHA1

4d2f0c95838477d1061b90c603e7458dd4f97379
SHA256

b76ee072028c1cd05806db20a4f215c90c62e18cbbc74e3de24e1ea4854c041d
SHA512

322eb05c8f613acef0d0f1e26df906e42da5ddef94540bdc7f3b82ff2b7d507f72172bf81130fd983b9be2e58047775b2669bb2b5322a2270d3add6685a296c7
SSDEEP

1536:hbmJzW30K5QPqfhVWbdsmA+RjPFLC+e5hN0ZGUGf2g:hSJaENPqfcxA+HFshNOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4792	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 8	4712	b76ee072028c1cd05806db20a4f215c90c62e18cbbc74e3de24e1ea4854c041d.exe	88
PID 4712 wrote to memory of 8	4712	b76ee072028c1cd05806db20a4f215c90c62e18cbbc74e3de24e1ea4854c041d.exe	88
PID 4712 wrote to memory of 8	4712	b76ee072028c1cd05806db20a4f215c90c62e18cbbc74e3de24e1ea4854c041d.exe	88
PID 8 wrote to memory of 4792	8	cmd.exe	91
PID 8 wrote to memory of 4792	8	cmd.exe	91
PID 8 wrote to memory of 4792	8	cmd.exe	91
PID 4792 wrote to memory of 1576	4792	[email protected]	92
PID 4792 wrote to memory of 1576	4792	[email protected]	92
PID 4792 wrote to memory of 1576	4792	[email protected]	92

C:\Users\Admin\AppData\Local\Temp\b76ee072028c1cd05806db20a4f215c90c62e18cbbc74e3de24e1ea4854c041d.exe
"C:\Users\Admin\AppData\Local\Temp\b76ee072028c1cd05806db20a4f215c90c62e18cbbc74e3de24e1ea4854c041d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:8
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4792
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:1576

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
84a3d60c547e49105779ad2b82bd2ed5

SHA1
af6aeeaca775e553d68d46bab49c51b726282cd8

SHA256
f5fbde91cc0845b14b42471b73c19ebf488d5131be9dafc35c8527fb646ef759

SHA512
8d0131e89c2d38e53e6ee56ce41e1c1f1926ce021aae80dc1ec3827aa26094490cc0f7e3f16b33d0f56a571a4f118cc34fdbf4b262c58f5cff4c89fe3d2d2228

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/4712-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4792-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download