fecbcf9a27d17ff8490e12eb78a2afb23ed4bfe77b03c0a1637c390f26345342

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 04:06

Target

ca85dead9e5b5c78bde999418cb1a3c6.exe
Size

435KB
MD5

ca85dead9e5b5c78bde999418cb1a3c6
SHA1

a2a80324723a749fea9277d998be6a96b710b9d7
SHA256

fecbcf9a27d17ff8490e12eb78a2afb23ed4bfe77b03c0a1637c390f26345342
SHA512

cf0335c98b11f83fde646edeef3d97b2b4e29cc97386c84fd53d831de49beb4d4eb39baa460be7fef934ca8944ae713fc43c6d6edbe62dcd100eb89d88d8211f
SSDEEP

12288:NW48Uekie0ghBNOZRmgWqlSuOO2pyOVfG14HWaSA:NW48Uekie/BN6RmXdu4QOVfG1GWa

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4228	4546.tmp

Executes dropped EXE 1 IoCs

pid	Process
4228	4546.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 4228	1564	ca85dead9e5b5c78bde999418cb1a3c6.exe	88
PID 1564 wrote to memory of 4228	1564	ca85dead9e5b5c78bde999418cb1a3c6.exe	88
PID 1564 wrote to memory of 4228	1564	ca85dead9e5b5c78bde999418cb1a3c6.exe	88

C:\Users\Admin\AppData\Local\Temp\ca85dead9e5b5c78bde999418cb1a3c6.exe
"C:\Users\Admin\AppData\Local\Temp\ca85dead9e5b5c78bde999418cb1a3c6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Users\Admin\AppData\Local\Temp\4546.tmp
  "C:\Users\Admin\AppData\Local\Temp\4546.tmp" --helpC:\Users\Admin\AppData\Local\Temp\ca85dead9e5b5c78bde999418cb1a3c6.exe 0140852C59E990259FBDA2E06D8006D33CA2BB38D865477A2FBAD89EA806A7DE7E96C66B273A742501A92BDBBC24A8C5A1C0B8C85FD905206365ED92BF213E3D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4228

C:\Users\Admin\AppData\Local\Temp\4546.tmp

Filesize
435KB

MD5
989f38bba9241cc68d502101c1ecacfb

SHA1
fdecaf2a93f2c48b8b9ec57de3febd2462526870

SHA256
7d5f472599592a50cb837f33701288fb46b36c9dcba0c84b5069ff4a128c4cab

SHA512
b0c591cdf9e2f1d7eed20d80e484805ffd148bd7b06dc9a4bd0601486c77bfc17ec7a2e59ef8b9978fe5c1a800d2ca4cc7dc1c8662054daa5555e3776771802a

Download Submit