6ad38b2a4428a81203b92d1f560d6170c13f171af5dd2e7712b069c4e2a2d540

Analysis

max time kernel
153s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 22:48

Target

6ad38b2a4428a81203b92d1f560d6170c13f171af5dd2e7712b069c4e2a2d540.exe
Size

767KB
MD5

10007826acd1aa3404bcfd4f4e203278
SHA1

ddd77f3326f51df26d8347516ff765b01c1f4a83
SHA256

6ad38b2a4428a81203b92d1f560d6170c13f171af5dd2e7712b069c4e2a2d540
SHA512

6f05c517845f40433f8cde33d2fda74f4d3dd4cc49fbd131331f1e10477c890a907883fbcf1fb9ce6aa8b7b0ffb84920009ebe95dcfc8b8626048e866c9e43db
SSDEEP

12288:sT+WFw6qgDZytk/cuoPGXqXOPHfMFlWaoiJ4FgxBC8KXP9rZt3xavCKJLZmzT1Sm:sTc6RMug8PH4WRiJtHKXTcLZmzT1Vb

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

7039.tmp

pid process

4544 7039.tmp

pid	process
4544	7039.tmp

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

6ad38b2a4428a81203b92d1f560d6170c13f171af5dd2e7712b069c4e2a2d540.exe

description	pid	process	target process
PID 3696 wrote to memory of 4544	3696	6ad38b2a4428a81203b92d1f560d6170c13f171af5dd2e7712b069c4e2a2d540.exe	7039.tmp
PID 3696 wrote to memory of 4544	3696	6ad38b2a4428a81203b92d1f560d6170c13f171af5dd2e7712b069c4e2a2d540.exe	7039.tmp
PID 3696 wrote to memory of 4544	3696	6ad38b2a4428a81203b92d1f560d6170c13f171af5dd2e7712b069c4e2a2d540.exe	7039.tmp

C:\Users\Admin\AppData\Local\Temp\6ad38b2a4428a81203b92d1f560d6170c13f171af5dd2e7712b069c4e2a2d540.exe
"C:\Users\Admin\AppData\Local\Temp\6ad38b2a4428a81203b92d1f560d6170c13f171af5dd2e7712b069c4e2a2d540.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3696

C:\Users\Admin\AppData\Local\Temp\7039.tmp
"C:\Users\Admin\AppData\Local\Temp\7039.tmp"
2⤵
- Executes dropped EXE
PID:4544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3772 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
1⤵
PID:1612

C:\Users\Admin\AppData\Local\Temp\7039.tmp

Filesize
767KB

MD5
79245a90c0ee783425c08b9256588550

SHA1
042da621afb190b68e069d05248d42ba47190721

SHA256
ee0e6b6f0b45de9ac65f3d228d23194449587f848424ddcbf7488540052d36e6

SHA512
19a8036c6f905754b345edfa055ca58519d702942f49784fca91e638290da84445b6c4672b1a6536c08ffc703dc455c8c8e047f755803d6dd094131b84667778

Download Submit