8221c7982843b2f7dcbef9f52a619b5347123f19adca1f09ea7b2f36db9dda1f

Analysis

max time kernel
129s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 23:45

Target

8221c7982843b2f7dcbef9f52a619b5347123f19adca1f09ea7b2f36db9dda1f.exe
Size

79KB
MD5

0041805ca0beccfcba79c138062ac04e
SHA1

232a1dc60c7bf3691f4d72dd49d34be4fb008c65
SHA256

8221c7982843b2f7dcbef9f52a619b5347123f19adca1f09ea7b2f36db9dda1f
SHA512

ca942def63178bdb637bfc3c70ba88affe7446c29a08c0f7868e9cb761de5d6c9ec4046a2d61afa84e2ca8bf7ca960647c9e5b1f9ce72e5217f4373467e2e9a2
SSDEEP

1536:zv9JlQP/CngmOQA8AkqUhMb2nuy5wgIP0CSJ+5ybB8GMGlZ5G:zv/SqgjGdqU7uy5w9WMybN5G

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

[email protected]

pid process

1888 [email protected]

pid	process
1888	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

8221c7982843b2f7dcbef9f52a619b5347123f19adca1f09ea7b2f36db9dda1f.execmd.exe

description	pid	process	target process
PID 2776 wrote to memory of 752	2776	8221c7982843b2f7dcbef9f52a619b5347123f19adca1f09ea7b2f36db9dda1f.exe	cmd.exe
PID 2776 wrote to memory of 752	2776	8221c7982843b2f7dcbef9f52a619b5347123f19adca1f09ea7b2f36db9dda1f.exe	cmd.exe
PID 2776 wrote to memory of 752	2776	8221c7982843b2f7dcbef9f52a619b5347123f19adca1f09ea7b2f36db9dda1f.exe	cmd.exe
PID 752 wrote to memory of 1888	752	cmd.exe	[email protected]
PID 752 wrote to memory of 1888	752	cmd.exe	[email protected]
PID 752 wrote to memory of 1888	752	cmd.exe	[email protected]

C:\Users\Admin\AppData\Local\Temp\8221c7982843b2f7dcbef9f52a619b5347123f19adca1f09ea7b2f36db9dda1f.exe
"C:\Users\Admin\AppData\Local\Temp\8221c7982843b2f7dcbef9f52a619b5347123f19adca1f09ea7b2f36db9dda1f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2776

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c [email protected]
2⤵
- Suspicious use of WriteProcessMemory
PID:752

C:\Users\Admin\AppData\Local\Temp\[email protected]
[email protected]
3⤵
- Executes dropped EXE
PID:1888

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
1696706d12de7c9a63acf6bb4f2f39b3

SHA1
ada0fed53df796c7cb6fc33ae32a67eae553c2d2

SHA256
1b87cf1f683e6ad71859323cd15156ff86b81f9b40d98d33df0a6c6c5d7370d5

SHA512
72226c36b091f075d48d65e537fdcbb2e1849dc7ecd101856bb17f1ab1a8b244b226868cbe91ea8c02f46016e535d24ad0813557b545ac02383b753c7450387c

Download Submit
memory/1888-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2776-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download