9feea16e7a15ac924eb5077d936a96c3c6b2ec3a973c16fb20102f9c7a1af0a2

Analysis

max time kernel
93s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2024, 00:55

Target

ccb1dd3c90e01c26ce55ce1985eb0ee2.exe
Size

1.9MB
MD5

ccb1dd3c90e01c26ce55ce1985eb0ee2
SHA1

75bdbd828131b188c799075df7954307a1e8ad3c
SHA256

9feea16e7a15ac924eb5077d936a96c3c6b2ec3a973c16fb20102f9c7a1af0a2
SHA512

235e950b9fa3cd25bd15c4613a03f964ef816df640e776ababd6e1747e5382e90939e008a41aeeddf332360b59e93051e8861e42028a5005de968f864c8849bd
SSDEEP

49152:Qoa1taC070dcZ7IuvkDIOwNYp2QmDpW6Thskn:Qoa1taC0NZvkDIO2Yp2QGW6lskn

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4268	4575.tmp

Executes dropped EXE 1 IoCs

pid	Process
4268	4575.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 4268	4796	ccb1dd3c90e01c26ce55ce1985eb0ee2.exe	85
PID 4796 wrote to memory of 4268	4796	ccb1dd3c90e01c26ce55ce1985eb0ee2.exe	85
PID 4796 wrote to memory of 4268	4796	ccb1dd3c90e01c26ce55ce1985eb0ee2.exe	85

C:\Users\Admin\AppData\Local\Temp\ccb1dd3c90e01c26ce55ce1985eb0ee2.exe
"C:\Users\Admin\AppData\Local\Temp\ccb1dd3c90e01c26ce55ce1985eb0ee2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Users\Admin\AppData\Local\Temp\4575.tmp
  "C:\Users\Admin\AppData\Local\Temp\4575.tmp" --splashC:\Users\Admin\AppData\Local\Temp\ccb1dd3c90e01c26ce55ce1985eb0ee2.exe AF043B727FDF22BF0A691CB0EC84EF83B19FBEA2AF492B1B9B95CB7D5AC008D581357446E49A497DE9E2CCA7DEE8473F6BF711643477F76C50F007D309D2E176
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4268

C:\Users\Admin\AppData\Local\Temp\4575.tmp

Filesize
980KB

MD5
7435c3b24771f69e8125fec7cec0ef70

SHA1
8921ba6702fc768870236bf23ac1fc0bc14e647c

SHA256
c7696a4b7782b77ab83fadabcec32d905fdee2cdc59f580c63f47c9bbce06850

SHA512
698a16c1e2ff7d3f32bf1fadb6b54a798f06ad19dec698add8a1b119c3996cbcff9a5f43809051382fd01634e182fdc0a64b386395167a712413f8f550e094b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\4575.tmp

Filesize
792KB

MD5
7ba27d90b681ded8966974e2052748d3

SHA1
c15ccd1c3134958438880b3d662dcccb8806c4e3

SHA256
3ec38bbeb9a4d171bd1e27c13b4362d562c0807669fb1bef8ef33447b730c467

SHA512
8f64f9589a1c14ffdc32d58147a34488246f141db99d5a753080e3e25b78adfdb28c783fbc679a1060d6308d2fa80dc9d415e71db46848fdbdfa6e9faf939515

Download Submit
memory/4268-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/4796-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download