b2275e14444b3212c19b78cdf25f74851f4d4092f0e32ed4d35ddb6aee5a9c86

Analysis

max time kernel
159s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23/04/2024, 15:52

Target

cs16-eng.exe
Size

262.2MB
MD5

47c6bc42ac4f0e1411427db81bb4fb4e
SHA1

9c020779a5c155c8110c8849c59aa099de1b17e6
SHA256

b2275e14444b3212c19b78cdf25f74851f4d4092f0e32ed4d35ddb6aee5a9c86
SHA512

e8c59615696df479cfd82655cd0f64954b81a51f2e328c5cb82997a46a5df2403ba016b991f6d2276ca609309f893f43fc54c635df4f528ec5d010847e9af183
SSDEEP

6291456:wUMXs+Qt/VZ+VZ5OhR/juaKFX3CX6ohYIHxZJPN7kkI88:pCyudOhR7wX3CKohpxNIRh

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2184	cs16-eng.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 2184	4448	cs16-eng.exe	89
PID 4448 wrote to memory of 2184	4448	cs16-eng.exe	89
PID 4448 wrote to memory of 2184	4448	cs16-eng.exe	89

C:\Users\Admin\AppData\Local\Temp\cs16-eng.exe
"C:\Users\Admin\AppData\Local\Temp\cs16-eng.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Users\Admin\AppData\Local\Temp\is-OR5L7.tmp\cs16-eng.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-OR5L7.tmp\cs16-eng.tmp" /SL5="$80062,274289404,145920,C:\Users\Admin\AppData\Local\Temp\cs16-eng.exe"
  2⤵
  - Executes dropped EXE
  PID:2184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3700 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:3732

C:\Users\Admin\AppData\Local\Temp\is-OR5L7.tmp\cs16-eng.tmp

Filesize
1.1MB

MD5
38500580ebb2187f95ba2116f236732d

SHA1
cf63a5fc216da7e7497f9b6126d5d994aab1f74c

SHA256
4d69ee6465dc04230d80fa5bd82fa522c784bfdd5be515109e9a80e75ffe195a

SHA512
05ddb22d74da9cc5e634ac9dc388049f94a57728fde95cb08992c7e1a03902b76640794666bf174b8421ed2231a6a853c6d30941a23ecdd5324bffa24f845aef

Download Submit
memory/2184-6-0x0000000000720000-0x0000000000721000-memory.dmp

Filesize
4KB

Download
memory/2184-9-0x0000000000400000-0x0000000000533000-memory.dmp

Filesize
1.2MB

Download
memory/2184-12-0x0000000000720000-0x0000000000721000-memory.dmp

Filesize
4KB

Download
memory/4448-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4448-2-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4448-8-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download