a6936625e74d09e2118a9b0a475bf9391495f047f046f7b63cfc319adebbc25f

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17-03-2024 09:09

Target

d07ccea4f401887ff1106c08c42e8110.exe
Size

5.5MB
MD5

d07ccea4f401887ff1106c08c42e8110
SHA1

79510087ee93e64cbbcb930ef6e61e620d619539
SHA256

a6936625e74d09e2118a9b0a475bf9391495f047f046f7b63cfc319adebbc25f
SHA512

96841848dafa59b9dc1f963c04550e72b2bb8a30818f90c639b2aff5978322b077c84bea0204b6027fc591f9914f9df8e5a4cac13e7059eba9795dc261b03e1a
SSDEEP

98304:DEU2EBrTRE1MVZeEEsAD6bm2DH0zjIQ1cMYo8C4EsgB:AsHRoMVENfgVMR8ztQ

Score

4^/10

Executes dropped EXE 1 IoCs

Processes:

d07ccea4f401887ff1106c08c42e8110.tmp

pid process

3784 d07ccea4f401887ff1106c08c42e8110.tmp

pid	process
3784	d07ccea4f401887ff1106c08c42e8110.tmp

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

d07ccea4f401887ff1106c08c42e8110.exe

description	pid	process	target process
PID 4912 wrote to memory of 3784	4912	d07ccea4f401887ff1106c08c42e8110.exe	d07ccea4f401887ff1106c08c42e8110.tmp
PID 4912 wrote to memory of 3784	4912	d07ccea4f401887ff1106c08c42e8110.exe	d07ccea4f401887ff1106c08c42e8110.tmp
PID 4912 wrote to memory of 3784	4912	d07ccea4f401887ff1106c08c42e8110.exe	d07ccea4f401887ff1106c08c42e8110.tmp

C:\Users\Admin\AppData\Local\Temp\d07ccea4f401887ff1106c08c42e8110.exe
"C:\Users\Admin\AppData\Local\Temp\d07ccea4f401887ff1106c08c42e8110.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4912

C:\Users\Admin\AppData\Local\Temp\is-2LM3A.tmp\d07ccea4f401887ff1106c08c42e8110.tmp
"C:\Users\Admin\AppData\Local\Temp\is-2LM3A.tmp\d07ccea4f401887ff1106c08c42e8110.tmp" /SL5="$600EA,5031305,780800,C:\Users\Admin\AppData\Local\Temp\d07ccea4f401887ff1106c08c42e8110.exe"
2⤵
- Executes dropped EXE
PID:3784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:1652

C:\Users\Admin\AppData\Local\Temp\is-2LM3A.tmp\d07ccea4f401887ff1106c08c42e8110.tmp

Filesize
2.5MB

MD5
8b6183936cdeaa7be9a3e646f826057a

SHA1
86543f76db3a131956a6e06c3c06ae7be9ed9462

SHA256
ef6f75ae2f1893254e9329ad9a5b77df33a8d501cebf3414447c6767fb0d7681

SHA512
90a34c5e01cf3dcf62e4367cafe8b98e0b15a6d6588211c2256a405b5a3d6ef91a682c1979626dba37bc815f48e684fe1e07051ee4d686799422c44b246f14e2

Download Submit
memory/3784-5-0x0000000000960000-0x0000000000961000-memory.dmp

Filesize
4KB

Download
memory/3784-10-0x0000000000400000-0x0000000000682000-memory.dmp

Filesize
2.5MB

Download
memory/3784-13-0x0000000000960000-0x0000000000961000-memory.dmp

Filesize
4KB

Download
memory/4912-0-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4912-9-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download