94fcfc63f883e15e61766f76b18e8fe5329c6d85509ff06ffc023a6a9f25bc3d

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 14:40

Target

Filme-mp4.exe
Size

3.1MB
MD5

d506527b8c16646f42f65cc71d9b1f55
SHA1

0ba81203b9a26a52c9c7b13806c224f541623d5c
SHA256

3b6ed09a37bb7caf72820e05b941f745032f834a6f47b9fec749dd7d98d76476
SHA512

d5405d76f2089fc8a4d5372eb459c88aff95da50c98755b8a1fb96937f6d8efe1b588ef26c83b26b7c135272ce7dbdba5d6b6069d2da491d2e14dff72d0eb1a5
SSDEEP

98304:BSpvmPP7k4zACZJqhmPJKHI7XjUgGJOmkI3LFfvqGR7:0I79zAWJYmPJKmQgji9H

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
996	Filme-mp4.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 996	4236	Filme-mp4.exe	82
PID 4236 wrote to memory of 996	4236	Filme-mp4.exe	82
PID 4236 wrote to memory of 996	4236	Filme-mp4.exe	82

C:\Users\Admin\AppData\Local\Temp\Filme-mp4.exe
"C:\Users\Admin\AppData\Local\Temp\Filme-mp4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Users\Admin\AppData\Local\Temp\is-TNKG8.tmp\Filme-mp4.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-TNKG8.tmp\Filme-mp4.tmp" /SL5="$60118,2804044,484864,C:\Users\Admin\AppData\Local\Temp\Filme-mp4.exe"
  2⤵
  - Executes dropped EXE
  PID:996

C:\Users\Admin\AppData\Local\Temp\is-TNKG8.tmp\Filme-mp4.tmp

Filesize
1.1MB

MD5
d70cb298b10ecaa8ff322a52c8e3bff5

SHA1
8d529f290210de683bb051d4fce5dae4659462a6

SHA256
65bb5c13261edcb09b52a9a712fa3ca34c36af7b73c15f63bfdc380005990049

SHA512
7134ad6b8c9e634a959c6f3f8750d4cf4d4f99f2aff08769d698c5001c8ce52e3755a734c8afb97c6457e9573049e8f23531e641019e33ffadefc5335ed7d722

Download Submit
memory/996-6-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/996-12-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/4236-0-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/4236-3-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/4236-11-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download