986e8bba41c94622b01850bd1c84548c18c60a0b09fb5792f944fc4a33cd908c

Analysis

max time kernel
136s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 03:46

Target

986e8bba41c94622b01850bd1c84548c18c60a0b09fb5792f944fc4a33cd908c.exe
Size

79KB
MD5

4d405a14359f051fa030ef4390ccb79b
SHA1

5db30a05a7310591e58cdcfaa2f5a12d428f7ea0
SHA256

986e8bba41c94622b01850bd1c84548c18c60a0b09fb5792f944fc4a33cd908c
SHA512

c72ca8704c5eaac1d7a66e5ac49234bfe2c816ce7de2a9b925781a935f23224b7eb32aca108f9d2373e63eae781d40bfb094911cb0f78ac2ebb82628a863e67c
SSDEEP

1536:zvANfA7voIfaFOQA8AkqUhMb2nuy5wgIP0CSJ+5yRB8GMGlZ5G:zvANfvi9GdqU7uy5w9WMyRN5G

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

[email protected]

pid process

212 [email protected]

pid	process
212	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

986e8bba41c94622b01850bd1c84548c18c60a0b09fb5792f944fc4a33cd908c.execmd.exe

description	pid	process	target process
PID 2400 wrote to memory of 4276	2400	986e8bba41c94622b01850bd1c84548c18c60a0b09fb5792f944fc4a33cd908c.exe	cmd.exe
PID 2400 wrote to memory of 4276	2400	986e8bba41c94622b01850bd1c84548c18c60a0b09fb5792f944fc4a33cd908c.exe	cmd.exe
PID 2400 wrote to memory of 4276	2400	986e8bba41c94622b01850bd1c84548c18c60a0b09fb5792f944fc4a33cd908c.exe	cmd.exe
PID 4276 wrote to memory of 212	4276	cmd.exe	[email protected]
PID 4276 wrote to memory of 212	4276	cmd.exe	[email protected]
PID 4276 wrote to memory of 212	4276	cmd.exe	[email protected]

C:\Users\Admin\AppData\Local\Temp\986e8bba41c94622b01850bd1c84548c18c60a0b09fb5792f944fc4a33cd908c.exe
"C:\Users\Admin\AppData\Local\Temp\986e8bba41c94622b01850bd1c84548c18c60a0b09fb5792f944fc4a33cd908c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2400

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c [email protected]
2⤵
- Suspicious use of WriteProcessMemory
PID:4276

C:\Users\Admin\AppData\Local\Temp\[email protected]
[email protected]
3⤵
- Executes dropped EXE
PID:212

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
6bb0a980282a45833d338db41178363d

SHA1
f092bd7836f838191f6757da05ff1c59c9823578

SHA256
7792ea3390a04d9f949352e1680ca876a0d9630460ad3adbe659833b3290d8ce

SHA512
b4f280f1e29ce8a2de9c32f1406acd32513a3e20ab2c869ab97d743fd233fa745b0e42ede532541811470da6494db62b89e03c543b369556a3d0054b3ba52785

Download Submit
memory/212-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2400-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download