8b49fc152c1417800fa752abf9aea6606d08830e1b168076aa30782d379beca3

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:46

Target

8b49fc152c1417800fa752abf9aea6606d08830e1b168076aa30782d379beca3.exe
Size

92KB
MD5

3a89eaedb67a3b87ff6b42999ed0874a
SHA1

20b0f343d60cbd20902372c28fc882e85f260f69
SHA256

8b49fc152c1417800fa752abf9aea6606d08830e1b168076aa30782d379beca3
SHA512

aba40925bd7c775f38c33cdaf7b6311776d2f8f21e9987f969b160b92f05e47fb74f95bc53ea6b36c9731c99afb0fac44eba839eed6a4019b5acfe85373f1a4f
SSDEEP

1536:qfDCb12udZsVJQuf3DkSEX6xAS7ounb9JGK7PS5VL7GHy/S6gpkioBbAVnONm/9G:XboSaJQaD7bFS55GHQcpcQONTiQua

Score

7^/10

Deletes itself 1 IoCs

Processes:

8b49fc152c1417800fa752abf9aea6606d08830e1b168076aa30782d379beca3.exe

pid process

4284 8b49fc152c1417800fa752abf9aea6606d08830e1b168076aa30782d379beca3.exe
Executes dropped EXE 1 IoCs

Processes:

8b49fc152c1417800fa752abf9aea6606d08830e1b168076aa30782d379beca3.exe

pid process

4284 8b49fc152c1417800fa752abf9aea6606d08830e1b168076aa30782d379beca3.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

8b49fc152c1417800fa752abf9aea6606d08830e1b168076aa30782d379beca3.exe

pid process

2844 8b49fc152c1417800fa752abf9aea6606d08830e1b168076aa30782d379beca3.exe

pid	process
4284	8b49fc152c1417800fa752abf9aea6606d08830e1b168076aa30782d379beca3.exe

pid	process
4284	8b49fc152c1417800fa752abf9aea6606d08830e1b168076aa30782d379beca3.exe

Suspicious use of UnmapMainImage 2 IoCs

Processes:

8b49fc152c1417800fa752abf9aea6606d08830e1b168076aa30782d379beca3.exe8b49fc152c1417800fa752abf9aea6606d08830e1b168076aa30782d379beca3.exe

pid	process
2844	8b49fc152c1417800fa752abf9aea6606d08830e1b168076aa30782d379beca3.exe
4284	8b49fc152c1417800fa752abf9aea6606d08830e1b168076aa30782d379beca3.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

8b49fc152c1417800fa752abf9aea6606d08830e1b168076aa30782d379beca3.exe

description	pid	process	target process
PID 2844 wrote to memory of 4284	2844	8b49fc152c1417800fa752abf9aea6606d08830e1b168076aa30782d379beca3.exe	8b49fc152c1417800fa752abf9aea6606d08830e1b168076aa30782d379beca3.exe
PID 2844 wrote to memory of 4284	2844	8b49fc152c1417800fa752abf9aea6606d08830e1b168076aa30782d379beca3.exe	8b49fc152c1417800fa752abf9aea6606d08830e1b168076aa30782d379beca3.exe
PID 2844 wrote to memory of 4284	2844	8b49fc152c1417800fa752abf9aea6606d08830e1b168076aa30782d379beca3.exe	8b49fc152c1417800fa752abf9aea6606d08830e1b168076aa30782d379beca3.exe

C:\Users\Admin\AppData\Local\Temp\8b49fc152c1417800fa752abf9aea6606d08830e1b168076aa30782d379beca3.exe
Filesize
92KB

MD5
5bf6d67c9fde593e5b5a6a9c9f43de78

SHA1
cca4ef030eebb20c5484f5de7667ad3b34ff2957

SHA256
35faaf2e868bd365d250eb6b25c50b97e4e9b6ebe04de914621ee38eb7cdb38a

SHA512
114e59619d4edf2eedf0f453a6cd5cc8cb033c4e6901ed07d6d2f3d1b98be1c231a88fb0a8914817ae9753be5638b9eeaaf6db5f80bca3527928885f1e5018c8

Download Submit
memory/2844-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2844-6-0x00000000001C0000-0x00000000001F1000-memory.dmp

Filesize
196KB

Download
memory/2844-1-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2844-11-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4284-13-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4284-19-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4284-24-0x00000000001B0000-0x00000000001E1000-memory.dmp

Filesize
196KB

Download
memory/4284-25-0x00000000014F0000-0x000000000150B000-memory.dmp

Filesize
108KB

Download