6bece177de176e59d126248ba6327a420587ceb0cad7daf0a2305df71a73c8ea

Analysis

max time kernel
133s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 22:50

Target

6bece177de176e59d126248ba6327a420587ceb0cad7daf0a2305df71a73c8ea.exe
Size

79KB
MD5

0da66588fa3eedbb76f3faa87c1d4d0d
SHA1

99471fec4e6b68297e9e8fa4dee45653d33a7636
SHA256

6bece177de176e59d126248ba6327a420587ceb0cad7daf0a2305df71a73c8ea
SHA512

77a1ea96b04129cf6a4e6265092bf0ad5677591a683240ed3cc2bd8e8d5613b262d0bebcf587e849347dd9467294aed384abefba63dea926484a15b8237c68c9
SSDEEP

1536:zvdtbD/STEiCoOQA8AkqUhMb2nuy5wgIP0CSJ+5y2B8GMGlZ5G:zvdtPS7CtGdqU7uy5w9WMy2N5G

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

[email protected]

pid process

1556 [email protected]

pid	process
1556	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

6bece177de176e59d126248ba6327a420587ceb0cad7daf0a2305df71a73c8ea.execmd.exe

description	pid	process	target process
PID 4432 wrote to memory of 3240	4432	6bece177de176e59d126248ba6327a420587ceb0cad7daf0a2305df71a73c8ea.exe	cmd.exe
PID 4432 wrote to memory of 3240	4432	6bece177de176e59d126248ba6327a420587ceb0cad7daf0a2305df71a73c8ea.exe	cmd.exe
PID 4432 wrote to memory of 3240	4432	6bece177de176e59d126248ba6327a420587ceb0cad7daf0a2305df71a73c8ea.exe	cmd.exe
PID 3240 wrote to memory of 1556	3240	cmd.exe	[email protected]
PID 3240 wrote to memory of 1556	3240	cmd.exe	[email protected]
PID 3240 wrote to memory of 1556	3240	cmd.exe	[email protected]

C:\Users\Admin\AppData\Local\Temp\6bece177de176e59d126248ba6327a420587ceb0cad7daf0a2305df71a73c8ea.exe
"C:\Users\Admin\AppData\Local\Temp\6bece177de176e59d126248ba6327a420587ceb0cad7daf0a2305df71a73c8ea.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4432

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c [email protected]
2⤵
- Suspicious use of WriteProcessMemory
PID:3240

C:\Users\Admin\AppData\Local\Temp\[email protected]
[email protected]
3⤵
- Executes dropped EXE
PID:1556

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
7785a1ca3fadfae9de61ccfb3584a7d7

SHA1
660667648191ca84b6675448a978d5fb0fd188c9

SHA256
c19acacf14c7934b94b9712b76aff24a8f10eacf67d0dc95d3e9d8c674c50458

SHA512
c18d87692034a66f91d2ce572fb561f6140e3264a42ad2b11a0612996b003bcb4355b8d97905cedbf8d1f3ae809428ddc05930dc2a398efb351db8d639edfd8c

Download Submit
memory/1556-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4432-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download