aa6009af5fb3b946a33258b686e6f8bfb0fadf3f7b811881c5aa64b0214d8821

Analysis

max time kernel
141s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 11:01

Target

jpwbCJK80/jpwbCJK.exe
Size

2.7MB
MD5

df59ed3f4eabc974d8a1d6880cff633b
SHA1

32b03cafbef31fbb04a90ce74d00548a3a4d9976
SHA256

a942353b36657d97abde65dac764616316c10db5cec38361bc3d0f4423753875
SHA512

f356bd0f7e30598449b10da0ae517413547f6e026db9604968ee190a61990ba5ffcef85c4bea8598ac1f062c19f39ed9ea91f0d2df71a92745396f4e752660fe
SSDEEP

49152:Hl0RNTWUM52OErI3NuI29ikf1IPh5Xlw/NjndSse/eDO8DyzzG3oBGHUhaEl0rjl:HlmNTE52OEE3NuT9hf1IPh5X6lb3FDO2

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1800	jpwbCJK.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 1800	216	jpwbCJK.exe	83
PID 216 wrote to memory of 1800	216	jpwbCJK.exe	83
PID 216 wrote to memory of 1800	216	jpwbCJK.exe	83

C:\Users\Admin\AppData\Local\Temp\jpwbCJK80\jpwbCJK.exe
"C:\Users\Admin\AppData\Local\Temp\jpwbCJK80\jpwbCJK.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:216
- C:\Users\Admin\AppData\Local\Temp\is-Q3RVK.tmp\jpwbCJK.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-Q3RVK.tmp\jpwbCJK.tmp" /SL5="$600EC,2463180,57856,C:\Users\Admin\AppData\Local\Temp\jpwbCJK80\jpwbCJK.exe"
  2⤵
  - Executes dropped EXE
  PID:1800

C:\Users\Admin\AppData\Local\Temp\is-Q3RVK.tmp\jpwbCJK.tmp

Filesize
703KB

MD5
208896db5485a092cb2364608f76b1e2

SHA1
772e070dae033efe0b97c0361106154e954f929c

SHA256
cf1c153b12899772966fcb22e4f25d32ee3685a29b85f1b82a4eb135f88a91cb

SHA512
753c7808a3c10b651c60257a34698a62f8d93f072b3a2e2a137e0e10013f9d98ce32bfcb98d8cd73c37a8aeb1a110130a8e6b718693cc47be4f7ec7fe61fc56e

Download Submit
memory/216-3-0x0000000000401000-0x000000000040C000-memory.dmp

Filesize
44KB

Download
memory/216-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/216-12-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1800-7-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/1800-13-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download