0a61772271cae0f578631759452db42930074974d588bc8995c7e52f7a916da7

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 03:16

Target

98f21680597a67f46f3653e6a08593ca.exe
Size

433KB
MD5

98f21680597a67f46f3653e6a08593ca
SHA1

335ca657bb8c8e172ea481f75d806d19520ff202
SHA256

0a61772271cae0f578631759452db42930074974d588bc8995c7e52f7a916da7
SHA512

879582357acf65733d90b2fa57feb9dc249a4c78aef2004ee03b9b6fd3302f8b556f895bfa322c49cc9ba8e6d1474c41257d4c6f37311295c4339d85c3723927
SSDEEP

12288:Ci4g+yU+0pAiv+V1hUbxxhVzghjj6nYBC9Ddf6pn:Ci4gXn0pD+VocknYc90

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4276	78E9.tmp

Executes dropped EXE 1 IoCs

pid	Process
4276	78E9.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 4276	1636	98f21680597a67f46f3653e6a08593ca.exe	97
PID 1636 wrote to memory of 4276	1636	98f21680597a67f46f3653e6a08593ca.exe	97
PID 1636 wrote to memory of 4276	1636	98f21680597a67f46f3653e6a08593ca.exe	97

C:\Users\Admin\AppData\Local\Temp\98f21680597a67f46f3653e6a08593ca.exe
"C:\Users\Admin\AppData\Local\Temp\98f21680597a67f46f3653e6a08593ca.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Users\Admin\AppData\Local\Temp\78E9.tmp
  "C:\Users\Admin\AppData\Local\Temp\78E9.tmp" --helpC:\Users\Admin\AppData\Local\Temp\98f21680597a67f46f3653e6a08593ca.exe 38997CDFA9B3B1150D231DFD13B07B5900C9E41EACE00845D3E18A407FA92609C48BEE32CD9C30E14AF9C4CA176C1C0AC1E4BC92F8F3FBEE21DFA729413694D6
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1384 --field-trial-handle=2496,i,15897292497548307209,13920214570023230813,262144 --variations-seed-version /prefetch:8
1⤵
PID:5004

C:\Users\Admin\AppData\Local\Temp\78E9.tmp

Filesize
433KB

MD5
b419908755297979b877459ea40b40f5

SHA1
beeca802efbc39587a185546e4bcd750560a8ad3

SHA256
eb776e7c775e8d4e33dbea56b186fbc6ea7991bbf4547ecaf543700fb71a8d1d

SHA512
3730d453583e9f8b71e0fb80f0330cb68e62fc2bde3af502c066b53776ed3215cef346ed6eb319f4ccb2ca96debdf7937968c27789da39cb921c2d27e1885394

Download Submit