42fd4051b33c7832bd5650c435a1f44033faf64b7dd50de29dc225ba9713d461

Analysis

max time kernel
156s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 19:22

Target

42fd4051b33c7832bd5650c435a1f44033faf64b7dd50de29dc225ba9713d461.exe
Size

73KB
MD5

fb06e0c4fa9943470fb12321a9d868c2
SHA1

9154fc0bfc1b6482dcfce0013b390a3d660aad49
SHA256

42fd4051b33c7832bd5650c435a1f44033faf64b7dd50de29dc225ba9713d461
SHA512

6f389b0104c27b2eeb0be438e0ad20e3bb49c9e6c70eee68c1a41ee45a19b56d7bca78471524682c875b196b031ffd800e7848983dfcdd25adb18e4d97d0d9a5
SSDEEP

1536:hbmdLcBW5s5K5QPqfhVWbdsmA+RjPFLC+e5hGQ0ZGUGf2g:hSdAf5NPqfcxA+HFsh7Og

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2328	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 488 wrote to memory of 1928	488	42fd4051b33c7832bd5650c435a1f44033faf64b7dd50de29dc225ba9713d461.exe	98
PID 488 wrote to memory of 1928	488	42fd4051b33c7832bd5650c435a1f44033faf64b7dd50de29dc225ba9713d461.exe	98
PID 488 wrote to memory of 1928	488	42fd4051b33c7832bd5650c435a1f44033faf64b7dd50de29dc225ba9713d461.exe	98
PID 1928 wrote to memory of 2328	1928	cmd.exe	99
PID 1928 wrote to memory of 2328	1928	cmd.exe	99
PID 1928 wrote to memory of 2328	1928	cmd.exe	99
PID 2328 wrote to memory of 2856	2328	[email protected]	100
PID 2328 wrote to memory of 2856	2328	[email protected]	100
PID 2328 wrote to memory of 2856	2328	[email protected]	100

C:\Users\Admin\AppData\Local\Temp\42fd4051b33c7832bd5650c435a1f44033faf64b7dd50de29dc225ba9713d461.exe
"C:\Users\Admin\AppData\Local\Temp\42fd4051b33c7832bd5650c435a1f44033faf64b7dd50de29dc225ba9713d461.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:488
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1928
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2328
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:2856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3976 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:2128

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
e91cf228201187dcc6d2746b6025be0d

SHA1
1967d9d4b31c828d7969b3466da6949d2f1643ef

SHA256
406908ef85a26c4e01851ed6f0a2007ee9afd92ee9fabf85e48614049a763518

SHA512
30e2f6ab249565a8c7c17621cc733e9b8cbced8f8cc81caffb544ee33b8e4074a7c2e05caca9fbfb0612ea104998c7f0099abbe4c159517eb826069f38b56f5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/488-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2328-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download