e9d2e9ff86e51a1d6cac00c9ebc889dc71bd1fe316610d7464e53b2dc6a22d58

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18/03/2024, 15:44

Target

18032024_2344_e9d2.exe
Size

2.8MB
MD5

48dccf139519b14cb99cb5ad01f9703f
SHA1

2b52daeae4a9ab38924ffd6188c6a52e4b3ab923
SHA256

e9d2e9ff86e51a1d6cac00c9ebc889dc71bd1fe316610d7464e53b2dc6a22d58
SHA512

4ed18f2248142c234ad1a2dd160fcbc5189c252a7aa566b10715aa01d84a2b3d7c3082d96f4c097e6600b18b1233b39f416d69a20f18f95dfbe1e9429f36157d
SSDEEP

49152:UsVQJELDqzO+pIdqLRq9r5PCxN9TG13SxBDxioLUn/Xvi3x9w5GOxYDjk3+dm:xVQJEfYOndAo0y1CBDxiOUnf7GOaXG

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2068	18032024_2344_e9d2.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 2068	4228	18032024_2344_e9d2.exe	88
PID 4228 wrote to memory of 2068	4228	18032024_2344_e9d2.exe	88
PID 4228 wrote to memory of 2068	4228	18032024_2344_e9d2.exe	88

C:\Users\Admin\AppData\Local\Temp\18032024_2344_e9d2.exe
"C:\Users\Admin\AppData\Local\Temp\18032024_2344_e9d2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Users\Admin\AppData\Local\Temp\is-C4SUG.tmp\18032024_2344_e9d2.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-C4SUG.tmp\18032024_2344_e9d2.tmp" /SL5="$70092,2491388,119296,C:\Users\Admin\AppData\Local\Temp\18032024_2344_e9d2.exe"
  2⤵
  - Executes dropped EXE
  PID:2068

C:\Users\Admin\AppData\Local\Temp\is-C4SUG.tmp\18032024_2344_e9d2.tmp

Filesize
1.1MB

MD5
be49cb708b9b78c088992095890fdbce

SHA1
2a05fb16f6b0e7f58ff975ecfb7e4181125ca474

SHA256
e24a20096eaf4c2a5c89d15d4e58efce8140e57ef86ca7f73ba7ca64deafc27d

SHA512
03283e5f5a931b9ebe790edd3945ddcd22f626cad11d9d679f3cc05ec8fdb342c70f6da1baff607e32d7fc678b9e84ce849082a1d57c3feaf4a45ab5c766edc8

Download Submit
memory/2068-6-0x0000000000680000-0x0000000000681000-memory.dmp

Filesize
4KB

Download
memory/2068-13-0x0000000000400000-0x000000000052B000-memory.dmp

Filesize
1.2MB

Download
memory/4228-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4228-14-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download