db042f296b58bb85ce3417abe2ac53f30070153bbd0c4421979fa9e498678490

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 03:38

Target

db042f296b58bb85ce3417abe2ac53f30070153bbd0c4421979fa9e498678490.exe
Size

668KB
MD5

590d98841745710be8c52ee52cb08803
SHA1

1bcd42c9bc833d2a89b71b265623bdceeeefb50b
SHA256

db042f296b58bb85ce3417abe2ac53f30070153bbd0c4421979fa9e498678490
SHA512

368e24073e906a1803212c31f3dcd0b644acc08f90011b72b1af76dd9d1248d94104ab3955ad8ab404678bc3e6eb1b677c9767b308030aa5965a814a4ab35858
SSDEEP

12288:UWBm+95nHfF2mgewFx5E+NfhRAZM4SiPP1kfgjdkAZgewF:UWBz95ndbgfx5NNgjTZgf

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3900	2D3A.tmp

Executes dropped EXE 1 IoCs

pid	Process
3900	2D3A.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 3900	1056	db042f296b58bb85ce3417abe2ac53f30070153bbd0c4421979fa9e498678490.exe	87
PID 1056 wrote to memory of 3900	1056	db042f296b58bb85ce3417abe2ac53f30070153bbd0c4421979fa9e498678490.exe	87
PID 1056 wrote to memory of 3900	1056	db042f296b58bb85ce3417abe2ac53f30070153bbd0c4421979fa9e498678490.exe	87

C:\Users\Admin\AppData\Local\Temp\db042f296b58bb85ce3417abe2ac53f30070153bbd0c4421979fa9e498678490.exe
"C:\Users\Admin\AppData\Local\Temp\db042f296b58bb85ce3417abe2ac53f30070153bbd0c4421979fa9e498678490.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Users\Admin\AppData\Local\Temp\2D3A.tmp
  "C:\Users\Admin\AppData\Local\Temp\2D3A.tmp" --pingC:\Users\Admin\AppData\Local\Temp\db042f296b58bb85ce3417abe2ac53f30070153bbd0c4421979fa9e498678490.exe D90A65FC4C8B5A31D02067C03235437104871AA8A451A2252DBC89095675B269481F5582EE851B0D1350197C6DA19ED0764C72D1BE612ED16170BF4A9BCB8914
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3900

C:\Users\Admin\AppData\Local\Temp\2D3A.tmp

Filesize
668KB

MD5
5a99202eb551fce5d335c09c85c83bc0

SHA1
28c17507de1899461baa1aaab3b4eff0d15ca6c6

SHA256
df7279f39011b04dba7350f8c53de2f60119688b1d965e382c74674fc3777324

SHA512
42f681b546e6446f36cc7eac0570d2f4c90cdc3071853c38d8997b7fa1f79bef33b4146157815efabccf6729688ed8e13c7ca217bed2c19cda2c86f796671a3d

Download Submit
memory/1056-0-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1056-7-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/3900-6-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/3900-9-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download