81d58cbcd28969eb9b27608c878b80e64b2e0c142bb89e879f3b2c53aeb66fb3

Analysis

max time kernel
114s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:08

Target

81d58cbcd28969eb9b27608c878b80e64b2e0c142bb89e879f3b2c53aeb66fb3.exe
Size

79KB
MD5

300f009d842ab0aead365e7a385b309f
SHA1

8ed03d64c5c37c2ed9c2bd5a9633607642f7154f
SHA256

81d58cbcd28969eb9b27608c878b80e64b2e0c142bb89e879f3b2c53aeb66fb3
SHA512

b6cdde2fb6c854e6489d7f2557ae1714a8b287ee342438b7543f38410273cf3a38b2be57659e01628ddb4a5ce0f61cf1451442bd9d3776387478f16c29ce1c79
SSDEEP

1536:zvDsKQrhOuesLDz2OQA8AkqUhMb2nuy5wgIP0CSJ+5yNB8GMGlZ5G:zv1QBLfTGdqU7uy5w9WMyNN5G

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

[email protected]

pid process

2876 [email protected]

pid	process
2876	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

81d58cbcd28969eb9b27608c878b80e64b2e0c142bb89e879f3b2c53aeb66fb3.execmd.exe

description	pid	process	target process
PID 3980 wrote to memory of 752	3980	81d58cbcd28969eb9b27608c878b80e64b2e0c142bb89e879f3b2c53aeb66fb3.exe	cmd.exe
PID 3980 wrote to memory of 752	3980	81d58cbcd28969eb9b27608c878b80e64b2e0c142bb89e879f3b2c53aeb66fb3.exe	cmd.exe
PID 3980 wrote to memory of 752	3980	81d58cbcd28969eb9b27608c878b80e64b2e0c142bb89e879f3b2c53aeb66fb3.exe	cmd.exe
PID 752 wrote to memory of 2876	752	cmd.exe	[email protected]
PID 752 wrote to memory of 2876	752	cmd.exe	[email protected]
PID 752 wrote to memory of 2876	752	cmd.exe	[email protected]

C:\Users\Admin\AppData\Local\Temp\81d58cbcd28969eb9b27608c878b80e64b2e0c142bb89e879f3b2c53aeb66fb3.exe
"C:\Users\Admin\AppData\Local\Temp\81d58cbcd28969eb9b27608c878b80e64b2e0c142bb89e879f3b2c53aeb66fb3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3980

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c [email protected]
2⤵
- Suspicious use of WriteProcessMemory
PID:752

C:\Users\Admin\AppData\Local\Temp\[email protected]
[email protected]
3⤵
- Executes dropped EXE
PID:2876

C:\Users\Admin\AppData\Local\Temp\[email protected]
Filesize
79KB

MD5
b26d2b8aec3638208a1a98365eec71d6

SHA1
3e40a24d73eb9bbaefaeb4d6e6b3c90d2b272f55

SHA256
97e30ed712b60cbf169dfbbdc4b5da5d85b13fe980da27a8187f5fdb10218343

SHA512
a309795d81eb641084fbf3cad34d3154c19821ea9be7a771bc8e99209225759b9305f0543e14d5753659e2e8c8ef345bb924b27aa712640626f16fec524f9b59

Download Submit
memory/2876-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3980-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download