5018cca1e4040dea39a15efe9ec4d183076a9500f5903d1edf5c6b7922e12c38

Analysis

max time kernel
134s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 01:07

Target

05ea1a045547b1590f3ae863606023e0.exe
Size

534KB
MD5

05ea1a045547b1590f3ae863606023e0
SHA1

8de6083da38e2e13e50833bb799c693d0499836e
SHA256

5018cca1e4040dea39a15efe9ec4d183076a9500f5903d1edf5c6b7922e12c38
SHA512

73d0469394b0d90825052ca40a594dac0e591360311af78b190ed919408b86c0aa1dfc207c9cfb907d7a48a0a6af7ca9b539ba4013b57deeab1788e5ee8abdb1
SSDEEP

12288:zWBm+95nHfF2mgewFE5reJydqMPS/Q6t1kfgjdkAsSOs:zWBz95ndbgfE5AmPSoVgjTsSOs

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2928	5A74.tmp

Executes dropped EXE 1 IoCs

pid	Process
2928	5A74.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 2928	3952	05ea1a045547b1590f3ae863606023e0.exe	84
PID 3952 wrote to memory of 2928	3952	05ea1a045547b1590f3ae863606023e0.exe	84
PID 3952 wrote to memory of 2928	3952	05ea1a045547b1590f3ae863606023e0.exe	84

C:\Users\Admin\AppData\Local\Temp\05ea1a045547b1590f3ae863606023e0.exe
"C:\Users\Admin\AppData\Local\Temp\05ea1a045547b1590f3ae863606023e0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Users\Admin\AppData\Local\Temp\5A74.tmp
  "C:\Users\Admin\AppData\Local\Temp\5A74.tmp" --pingC:\Users\Admin\AppData\Local\Temp\05ea1a045547b1590f3ae863606023e0.exe 7A2A853173800F8352DDFD906782939EF65A8D8BB9D8D9549E24BE48DB2AC833B3065449F1B9567FF0C84544CA4BA4EE586B5C1E190BDF8A5AC0832A8D056FBF
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2928

C:\Users\Admin\AppData\Local\Temp\5A74.tmp

Filesize
534KB

MD5
6833adf0cbb588ee2b79cbc31d9a4b4c

SHA1
a3aa68e19a415b15e0532b9ead80b96f0737ca6a

SHA256
307aedd23dd4e9b1f40180b5aab55a7de6e76f83b03021515158a52767f61147

SHA512
62a1146a7b3e4c12fca91b6a0d62aefa0446b0fdf2db763a7d40d78c1bf80eb453b3d376eb451859f56a8ce62a82a50b5313118cf1bfa51e45a181b8b5b867e4

Download Submit
memory/2928-6-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/2928-7-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/3952-0-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/3952-5-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download