0fcb08516d9572bc7097f51e2466be36496b9f3d95259899c79f5cc0cf96e1bc

Analysis

max time kernel
152s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14-03-2024 20:13

Target

c9840f74eeb0b6c01022506c230cc929.exe
Size

190KB
MD5

c9840f74eeb0b6c01022506c230cc929
SHA1

61fa04db461189490d384f66646c642ada479f21
SHA256

0fcb08516d9572bc7097f51e2466be36496b9f3d95259899c79f5cc0cf96e1bc
SHA512

18b3dda911e28ba078dd8a8e9d7a59493662712e3a3d5f00940da9a00df175bc1cfb4edcdc2cb988ea305910bc0a6a68bac3f52bacc363bfefff0ad20e99f736
SSDEEP

3072:S14uFp/3nIjuwDqBBuCHi3jt24ej3YQesxqllkCQdM1:S142nR9bHi3jo4ej3YQeUqUCgM1

Score

7^/10

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

4580 svchost.exe

pid	process
4580	svchost.exe

Drops startup file 2 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dxdiag.exe	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dxdiag.exe	svchost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

c9840f74eeb0b6c01022506c230cc929.exe

pid process

4916 c9840f74eeb0b6c01022506c230cc929.exe

pid	process
4916	c9840f74eeb0b6c01022506c230cc929.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c9840f74eeb0b6c01022506c230cc929.exe

description	pid	process	target process
PID 4916 wrote to memory of 4580	4916	c9840f74eeb0b6c01022506c230cc929.exe	svchost.exe
PID 4916 wrote to memory of 4580	4916	c9840f74eeb0b6c01022506c230cc929.exe	svchost.exe
PID 4916 wrote to memory of 4580	4916	c9840f74eeb0b6c01022506c230cc929.exe	svchost.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:4288

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dxdiag.exe
Filesize
190KB

MD5
c9840f74eeb0b6c01022506c230cc929

SHA1
61fa04db461189490d384f66646c642ada479f21

SHA256
0fcb08516d9572bc7097f51e2466be36496b9f3d95259899c79f5cc0cf96e1bc

SHA512
18b3dda911e28ba078dd8a8e9d7a59493662712e3a3d5f00940da9a00df175bc1cfb4edcdc2cb988ea305910bc0a6a68bac3f52bacc363bfefff0ad20e99f736

Download Submit
memory/4580-5-0x0000000000EC0000-0x0000000000EC2000-memory.dmp

Filesize
8KB

Download
memory/4580-9-0x0000000000EC0000-0x0000000000EC2000-memory.dmp

Filesize
8KB

Download
memory/4580-53-0x0000000000EC0000-0x0000000000EC2000-memory.dmp

Filesize
8KB

Download
memory/4916-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4916-1-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/4916-2-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4916-3-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download