035bd7a9bbf8fe410389c71990ebac3f07cd8cf69d8dbab991f477746902cb56

Analysis

max time kernel
55s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 18:14

Target

035bd7a9bbf8fe410389c71990ebac3f07cd8cf69d8dbab991f477746902cb56.exe
Size

736KB
MD5

d3b83feb3e0158463cfe3d2355edffbc
SHA1

f79c057c1c214b4d7d1a737f7439c83bb01dc314
SHA256

035bd7a9bbf8fe410389c71990ebac3f07cd8cf69d8dbab991f477746902cb56
SHA512

5174b29ab6758401ee873a640e4cec8592a055d45ae2c460caaa073f69965a77c24f4c81416510562fcf4f8b4aaaaaa979ffe677ca4c60a36aff4a27695dc058
SSDEEP

12288:IWBm+95nHfF2mgewFx5AZrfpI3vTckaIw+zZ1kfgjdkAW10iwJZnEIf6qCWpJKtR:IWBz95ndbgfx5QrBIQkHw9gjTW10iwJS

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3636	3FD8.tmp

Executes dropped EXE 1 IoCs

pid	Process
3636	3FD8.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 3636	3100	035bd7a9bbf8fe410389c71990ebac3f07cd8cf69d8dbab991f477746902cb56.exe	84
PID 3100 wrote to memory of 3636	3100	035bd7a9bbf8fe410389c71990ebac3f07cd8cf69d8dbab991f477746902cb56.exe	84
PID 3100 wrote to memory of 3636	3100	035bd7a9bbf8fe410389c71990ebac3f07cd8cf69d8dbab991f477746902cb56.exe	84

C:\Users\Admin\AppData\Local\Temp\035bd7a9bbf8fe410389c71990ebac3f07cd8cf69d8dbab991f477746902cb56.exe
"C:\Users\Admin\AppData\Local\Temp\035bd7a9bbf8fe410389c71990ebac3f07cd8cf69d8dbab991f477746902cb56.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Users\Admin\AppData\Local\Temp\3FD8.tmp
  "C:\Users\Admin\AppData\Local\Temp\3FD8.tmp" --pingC:\Users\Admin\AppData\Local\Temp\035bd7a9bbf8fe410389c71990ebac3f07cd8cf69d8dbab991f477746902cb56.exe 18BC243F6227B606AC809C4C3C98AF894A8ECBEACB5436D0C439FD74970FAC1401D504A0839768B4DBADBB2FB011C2763BF291B20BEC0E8B2E12AE5B9679EAD0
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3636

C:\Users\Admin\AppData\Local\Temp\3FD8.tmp

Filesize
736KB

MD5
44bab103f978143afe87bc4c2c88b59d

SHA1
e695cd66faa1d503da06ccd0bf63775b8e4ba513

SHA256
51a8e12b402803110941ae4c1369de2e737f9259680e5c3d51aa06f2c869be87

SHA512
64848fc276f0ee5ba91cb4250d40aa3342bb736cf7fa40e5d2560b55f6a5c7bc96d45618cece45fb22f27e13a6327bf438ad8f7c1704f2e05ce0b3abcfba9977

Download Submit
memory/3100-0-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/3100-6-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/3636-4-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/3636-7-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download