dcbd7cda9cc471484267f670d7e3db61ff23206257e43e21c43b64d029a593ae

Analysis

max time kernel
152s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03-05-2024 04:15

Target

dcbd7cda9cc471484267f670d7e3db61ff23206257e43e21c43b64d029a593ae.exe
Size

36KB
MD5

48eac09ab83073fd9d5c8f7ead19ab95
SHA1

cbcaab353b8e84fed01b28c8fbdfb6e2132f8feb
SHA256

dcbd7cda9cc471484267f670d7e3db61ff23206257e43e21c43b64d029a593ae
SHA512

44b3e3ffee59f1666d5f3d579dc1dab25bb29446f70c9ac5f8a77c6b5b6b7aa60a2eac23fc7c0b27107917a0fe2f98bcbbbe0cc106aa913a2e8467871370e15e
SSDEEP

384:cKUDthWY/ANpYL3QVvSwBRcDgYCNXGQaI/I51Ee2m3wJp6R3IYsBl3VRBJ:SWTNyMhhvcgNWQBG1Ee/Mg6dTBJ

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4564	bxqyy.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 4564	4796	dcbd7cda9cc471484267f670d7e3db61ff23206257e43e21c43b64d029a593ae.exe	91
PID 4796 wrote to memory of 4564	4796	dcbd7cda9cc471484267f670d7e3db61ff23206257e43e21c43b64d029a593ae.exe	91
PID 4796 wrote to memory of 4564	4796	dcbd7cda9cc471484267f670d7e3db61ff23206257e43e21c43b64d029a593ae.exe	91

C:\Users\Admin\AppData\Local\Temp\dcbd7cda9cc471484267f670d7e3db61ff23206257e43e21c43b64d029a593ae.exe
"C:\Users\Admin\AppData\Local\Temp\dcbd7cda9cc471484267f670d7e3db61ff23206257e43e21c43b64d029a593ae.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Users\Admin\AppData\Local\Temp\bxqyy.exe
  C:\Users\Admin\AppData\Local\Temp\bxqyy.exe
  2⤵
  - Executes dropped EXE
  PID:4564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1036 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:2876

C:\Users\Admin\AppData\Local\Temp\bxqyy.exe

Filesize
36KB

MD5
cb85e5614c73d87c70b4b51aa6bc8384

SHA1
4699d9dbbd8769b4eae49f71c713697b2bb01a5e

SHA256
00a62bc24a621500b6d363da8ac081587249238bf59147ef5e81476466ab62f7

SHA512
88cb0961fb19d1065854f2c6f176f9382d4939b6068c1da9b5f49a25d42869cd09fa90fadf5f03da31fd74eb7eaba43c80ec5113e316626a7de07df62d853821

Download Submit
memory/4564-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4796-0-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download