7a21d91fd51fc2c929c50b61b858a40943619c7451588b235b020fb89dbae3d5

Analysis

max time kernel
140s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 23:26

Target

7a21d91fd51fc2c929c50b61b858a40943619c7451588b235b020fb89dbae3d5.exe
Size

79KB
MD5

0dbbdfb374a6b5863ac3dc6dd6e09f12
SHA1

b93cc5c0b6361c96fa4df88823bf37f1272d65c5
SHA256

7a21d91fd51fc2c929c50b61b858a40943619c7451588b235b020fb89dbae3d5
SHA512

d4184d79bba98609736769f7600aa58ba681b0fec817a0808cf2ab75c3beaaec9c814d14677381164e773b56fc8ae129e17d1f10cffc8eb3475daa2270ca2edf
SSDEEP

1536:zvANfA7voIfaFOQA8AkqUhMb2nuy5wgIP0CSJ+5ydB8GMGlZ5G:zvANfvi9GdqU7uy5w9WMydN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4848	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 5052	2748	7a21d91fd51fc2c929c50b61b858a40943619c7451588b235b020fb89dbae3d5.exe	86
PID 2748 wrote to memory of 5052	2748	7a21d91fd51fc2c929c50b61b858a40943619c7451588b235b020fb89dbae3d5.exe	86
PID 2748 wrote to memory of 5052	2748	7a21d91fd51fc2c929c50b61b858a40943619c7451588b235b020fb89dbae3d5.exe	86
PID 5052 wrote to memory of 4848	5052	cmd.exe	87
PID 5052 wrote to memory of 4848	5052	cmd.exe	87
PID 5052 wrote to memory of 4848	5052	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\7a21d91fd51fc2c929c50b61b858a40943619c7451588b235b020fb89dbae3d5.exe
"C:\Users\Admin\AppData\Local\Temp\7a21d91fd51fc2c929c50b61b858a40943619c7451588b235b020fb89dbae3d5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:4848

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
871c5fb9115e010ff5606b07b60340fb

SHA1
9aa6432a4ba263430491b799e2a03daf9e085f8d

SHA256
3b53b119e19e7c21082328a342b9ec1514efbe797bf602a01e7975cda8a36017

SHA512
f02ba3ddda3be2f2338852cc3981bad9a24081d8aac73a753d3bc1d10ed0486d6fa27a69d9ed36d041831a3946058bbac116cd280e88630b60d7432c842f6cb0

Download Submit
memory/2748-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4848-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download