c37dacd94780a607ad2aa06ab288030f5756bfc8ba6be015507a6e21734a9c36

Analysis

max time kernel
1792s
max time network
1176s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 15:29

Target

Kiwi X Executor.exe
Size

1.7MB
MD5

53ce0a66e95d3e2cbee50bfe633819ae
SHA1

32a6c7aec137a156b3fbbee2396adcbff7d1d565
SHA256

105955ad6cfc64eb1369189409644a4fbda1cdf28f4b0416f6be80dc68ef15c6
SHA512

89264b0584d25a33254574efc26ec36f198740d5fed246aa5cadc8d04948beefd936c3380d39fa1a9f8640be08ec2ea9806083090328a3c9784bb1e8ca86335f
SSDEEP

24576:s7FUDowAyrTVE3U5F/jGqK6Kic6QL3E2vVsjECUAQT45deRV9RE:sBuZrEUuYKIy029s4C1eH92

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

Kiwi X Executor.tmp

pid process

4420 Kiwi X Executor.tmp
Loads dropped DLL 1 IoCs

Processes:

Kiwi X Executor.tmp

pid process

4420 Kiwi X Executor.tmp

pid	process
4420	Kiwi X Executor.tmp

pid	process
4420	Kiwi X Executor.tmp

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Kiwi X Executor.exe

description	pid	process	target process
PID 1680 wrote to memory of 4420	1680	Kiwi X Executor.exe	Kiwi X Executor.tmp
PID 1680 wrote to memory of 4420	1680	Kiwi X Executor.exe	Kiwi X Executor.tmp
PID 1680 wrote to memory of 4420	1680	Kiwi X Executor.exe	Kiwi X Executor.tmp

C:\Users\Admin\AppData\Local\Temp\Kiwi X Executor.exe
"C:\Users\Admin\AppData\Local\Temp\Kiwi X Executor.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1680

C:\Users\Admin\AppData\Local\Temp\is-I1I2Q.tmp\Kiwi X Executor.tmp

Filesize
3.1MB

MD5
de38c19cc651f5370e608c0a97a62aa9

SHA1
dfd454cf959717f093d8399c75ff6eb32428ece5

SHA256
6e568f62350cb258a0203ebce4bfdcc6f66d24de27e2782df35a1504eea889d9

SHA512
bb4a1cb3e353c60c486dcf8fafe0192b68b3f15f9c48d54da9df5412ef3527b79fe8ea909878f70a96fafbf8bd0b03965b7b0102738ecd97392677df91716e3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-R59U1.tmp\idp.dll

Filesize
232KB

MD5
55c310c0319260d798757557ab3bf636

SHA1
0892eb7ed31d8bb20a56c6835990749011a2d8de

SHA256
54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed

SHA512
e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57

Download Submit
memory/1680-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1680-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/1680-12-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4420-6-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/4420-13-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download