0987520da34dea85ac909d8301e01ab8a71d538138ae4779830ea93d4bfaea32

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 10:00

Target

cb1e16187a9f502d0dc1708d8709d9a7.exe
Size

22KB
MD5

cb1e16187a9f502d0dc1708d8709d9a7
SHA1

5dea9a4c0c48b86ed796df0bb0665a2833d86497
SHA256

0987520da34dea85ac909d8301e01ab8a71d538138ae4779830ea93d4bfaea32
SHA512

141ccc501d0047c27e4dd29beb1908b2b10ac7ff524fecb5fd57c6867abc127ffc83861ee42f4ac1598fa80e5e68440b0e1ba83864aa46f8986c650722de1622
SSDEEP

384:6Ih83DQGBmqeQft0cLeyncYocafiB7IM0I4w3dSt8cKQMZE9EgjaYWfxlOW:6GOQGBmhQft0WVcYoc58M0+NSfKFq38

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\cb1e16187a9f502d0dc1708d8709d9a7.exe	cb1e16187a9f502d0dc1708d8709d9a7.exe
File created	C:\Windows\SysWOW64\cb1e16187a9f502d0dc1708d8709d9a7.exe	cb1e16187a9f502d0dc1708d8709d9a7.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 4360	2768	cb1e16187a9f502d0dc1708d8709d9a7.exe	96
PID 2768 wrote to memory of 4360	2768	cb1e16187a9f502d0dc1708d8709d9a7.exe	96
PID 2768 wrote to memory of 4360	2768	cb1e16187a9f502d0dc1708d8709d9a7.exe	96

C:\Users\Admin\AppData\Local\Temp\cb1e16187a9f502d0dc1708d8709d9a7.exe
"C:\Users\Admin\AppData\Local\Temp\cb1e16187a9f502d0dc1708d8709d9a7.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Users\Admin\AppData\Local\Temp\cb1e16187a9f502d0dc1708d8709d9a7.exe
  C:\Users\Admin\AppData\Local\Temp\cb1e16187a9f502d0dc1708d8709d9a7.exe start
  2⤵
  PID:4360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3936 --field-trial-handle=2232,i,11267738607351977302,107266978269557304,262144 --variations-seed-version /prefetch:8
1⤵
PID:1084

memory/2768-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2768-1-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2768-5-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4360-3-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4360-4-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4360-6-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4360-22-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download