41bf46298070bc0e5629d4e870bc39f49bcfffaa24d71fc2dd045288d18bdefe

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22/04/2024, 21:19

Target

41bf46298070bc0e5629d4e870bc39f49bcfffaa24d71fc2dd045288d18bdefe.exe
Size

539KB
MD5

c3f161ed6ffc8dc25892ffaaf47d978f
SHA1

c04b0e4bec6b320bdb1bc7b71172a5b3dfa0f8fc
SHA256

41bf46298070bc0e5629d4e870bc39f49bcfffaa24d71fc2dd045288d18bdefe
SHA512

e4979e42814414c9496cdf7896030c1ed9a356be1fdd6f9ba35090015144a74ac4529f5ad81e9a3a7e3cfb87e24454d8d0a10107544bd11705aade71bff986d8
SSDEEP

12288:Ld8dsHx2FNIEtOIUwdQVPrHTD/iVayBc18bCCwO+TalLN:LdfxkOEtEGQVDzGV9cimCwO+TalLN

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2812	599.tmp

Executes dropped EXE 1 IoCs

pid	Process
2812	599.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3544 wrote to memory of 2812	3544	41bf46298070bc0e5629d4e870bc39f49bcfffaa24d71fc2dd045288d18bdefe.exe	91
PID 3544 wrote to memory of 2812	3544	41bf46298070bc0e5629d4e870bc39f49bcfffaa24d71fc2dd045288d18bdefe.exe	91
PID 3544 wrote to memory of 2812	3544	41bf46298070bc0e5629d4e870bc39f49bcfffaa24d71fc2dd045288d18bdefe.exe	91

C:\Users\Admin\AppData\Local\Temp\41bf46298070bc0e5629d4e870bc39f49bcfffaa24d71fc2dd045288d18bdefe.exe
"C:\Users\Admin\AppData\Local\Temp\41bf46298070bc0e5629d4e870bc39f49bcfffaa24d71fc2dd045288d18bdefe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Users\Admin\AppData\Local\Temp\599.tmp
  "C:\Users\Admin\AppData\Local\Temp\599.tmp" --pingC:\Users\Admin\AppData\Local\Temp\41bf46298070bc0e5629d4e870bc39f49bcfffaa24d71fc2dd045288d18bdefe.exe F8993461A98C474C144F234D86D88816D3A02FE53DDBE40E5993500F0EFD8F5EA714C05FD8284783ECFDBD03E91031305B222DAB0DE887C6B50C9FB5081BF99B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1324 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:5828

C:\Users\Admin\AppData\Local\Temp\599.tmp

Filesize
539KB

MD5
36ee540e496166da8245cf76a1ca1447

SHA1
db4d0263d95ae936a274abd54f4d9cd9acbcfd3a

SHA256
8b780047cafe458c743a7b2af2f439221b8487e9023fea239a539fb792ff767c

SHA512
24f026038f3b6df6178b751a3dee7f76c3d522b4c0b9f5240bd82449f0941d73deaef266036561c81c28f89816f9987d60b395b649b19de7383e488418219fe3

Download Submit