0d53a1cd332e2327a96d03addac11e90aa1a119f1c9035bb03ad7cf5c6098687

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-03-2024 11:41

Target

ddec4f0f200c6401440e94f9db8ab58c.exe
Size

92KB
MD5

ddec4f0f200c6401440e94f9db8ab58c
SHA1

f938552713be6226a7132cec221b4243a12a5b38
SHA256

0d53a1cd332e2327a96d03addac11e90aa1a119f1c9035bb03ad7cf5c6098687
SHA512

7183acf4f7535304cee4fe1667f413088bec51c67ee8eafd481db62c657c1981e8fd340403914c9cb6b62a4884cd9cf36a713fef65111f4fe21ebc78256f2e41
SSDEEP

1536:ZBwd7Knfg6GS/joyZ+fmFb/8cE1emozPcj4knTYVq+UM7E1CFcUm4KT8:8MfiENAOFDk2lkUVq+UMuycUX

Score

8^/10

evasion

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4384	ddec4f0f200c6401440e94f9db8ab58c.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 4384	4072	ddec4f0f200c6401440e94f9db8ab58c.exe	83
PID 4072 wrote to memory of 4384	4072	ddec4f0f200c6401440e94f9db8ab58c.exe	83
PID 4072 wrote to memory of 4384	4072	ddec4f0f200c6401440e94f9db8ab58c.exe	83
PID 4384 wrote to memory of 824	4384	ddec4f0f200c6401440e94f9db8ab58c.exe	92
PID 4384 wrote to memory of 824	4384	ddec4f0f200c6401440e94f9db8ab58c.exe	92
PID 4384 wrote to memory of 824	4384	ddec4f0f200c6401440e94f9db8ab58c.exe	92

C:\Users\Admin\AppData\Local\Temp\ddec4f0f200c6401440e94f9db8ab58c.exe
"C:\Users\Admin\AppData\Local\Temp\ddec4f0f200c6401440e94f9db8ab58c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Users\Admin\AppData\Local\Temp\ddec4f0f200c6401440e94f9db8ab58c.exe
  "C:\Users\Admin\AppData\Local\Temp\ddec4f0f200c6401440e94f9db8ab58c.exe" del
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Windows\SysWOW64\cmd.exe
    /c del C:\Users\Admin\AppData\Local\Temp\DDEC4F~1.EXE.tmp >> NUL
    3⤵
    PID:824