8f3727f8cf1e956e77b4bbd49aabd126e5585f217203c8f7b82ceee555cb2f60

Analysis

max time kernel
138s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 03:01

Target

8f3727f8cf1e956e77b4bbd49aabd126e5585f217203c8f7b82ceee555cb2f60.exe
Size

79KB
MD5

653bd32de172ba90c20ab46f200e7bd5
SHA1

7891ee3837762f02d02353597662bee59574b7de
SHA256

8f3727f8cf1e956e77b4bbd49aabd126e5585f217203c8f7b82ceee555cb2f60
SHA512

998858633e531587a26699947a4cf3194790278f65c0090cca0f0acd3eef209d6411f42787263f6bf1eea5603b928a0611198a1ee21f8be337d1aefedb38980c
SSDEEP

1536:zvMWqzr6NpAOQA8AkqUhMb2nuy5wgIP0CSJ+5ylB8GMGlZ5G:zvMtzrEGdqU7uy5w9WMylN5G

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

[email protected]

pid process

4732 [email protected]

pid	process
4732	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

8f3727f8cf1e956e77b4bbd49aabd126e5585f217203c8f7b82ceee555cb2f60.execmd.exe

description	pid	process	target process
PID 4964 wrote to memory of 3464	4964	8f3727f8cf1e956e77b4bbd49aabd126e5585f217203c8f7b82ceee555cb2f60.exe	cmd.exe
PID 4964 wrote to memory of 3464	4964	8f3727f8cf1e956e77b4bbd49aabd126e5585f217203c8f7b82ceee555cb2f60.exe	cmd.exe
PID 4964 wrote to memory of 3464	4964	8f3727f8cf1e956e77b4bbd49aabd126e5585f217203c8f7b82ceee555cb2f60.exe	cmd.exe
PID 3464 wrote to memory of 4732	3464	cmd.exe	[email protected]
PID 3464 wrote to memory of 4732	3464	cmd.exe	[email protected]
PID 3464 wrote to memory of 4732	3464	cmd.exe	[email protected]

C:\Users\Admin\AppData\Local\Temp\8f3727f8cf1e956e77b4bbd49aabd126e5585f217203c8f7b82ceee555cb2f60.exe
"C:\Users\Admin\AppData\Local\Temp\8f3727f8cf1e956e77b4bbd49aabd126e5585f217203c8f7b82ceee555cb2f60.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4964

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c [email protected]
2⤵
- Suspicious use of WriteProcessMemory
PID:3464

C:\Users\Admin\AppData\Local\Temp\[email protected]
[email protected]
3⤵
- Executes dropped EXE
PID:4732

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
c96ab66fd7015cc220117a6a0b848ce5

SHA1
b634c3748edd77092bf5820cc7e8c5e9a1babcb7

SHA256
a62960a66492151d47a7251685f7e522aa84e60351bea919980eb3b1d15497b7

SHA512
b285d028abda1fef716e80bd55b35b39f22a2368a2f22e98527a25309d1da397a6098bbaa68a1a5019c456a061bc618c9d84c50ce0fa33c8237e30f28a4d8d4a

Download Submit
memory/4732-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4964-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download