1dabf4e2be0ea69badcd37fee475fa06800e7a3bbc379bc1c94bd8f4df7ae3e1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 19:22

Target

1dabf4e2be0ea69badcd37fee475fa06800e7a3bbc379bc1c94bd8f4df7ae3e1.exe
Size

79KB
MD5

116e385aa48e8d5ba14a4c5fcfdb1efa
SHA1

d731aea05b71e49a9d3894904376ed70d2c130bf
SHA256

1dabf4e2be0ea69badcd37fee475fa06800e7a3bbc379bc1c94bd8f4df7ae3e1
SHA512

5fdaa8d40a5d024853ffeb96d1a927f635352e518290f99a854b6f9e9f6c6dab4a3e74a24ea8907effdf60a7a9caef0e09bdbb878d3f2b0ecc5b057942f9d07e
SSDEEP

1536:zvlIj2RxFr51zXOQA8AkqUhMb2nuy5wgIP0CSJ+5yLB8GMGlZ5G:zvqjWFr+GdqU7uy5w9WMyLN5G

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

[email protected]

pid process

4264 [email protected]

pid	process
4264	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

1dabf4e2be0ea69badcd37fee475fa06800e7a3bbc379bc1c94bd8f4df7ae3e1.execmd.exe

description	pid	process	target process
PID 4912 wrote to memory of 916	4912	1dabf4e2be0ea69badcd37fee475fa06800e7a3bbc379bc1c94bd8f4df7ae3e1.exe	cmd.exe
PID 4912 wrote to memory of 916	4912	1dabf4e2be0ea69badcd37fee475fa06800e7a3bbc379bc1c94bd8f4df7ae3e1.exe	cmd.exe
PID 4912 wrote to memory of 916	4912	1dabf4e2be0ea69badcd37fee475fa06800e7a3bbc379bc1c94bd8f4df7ae3e1.exe	cmd.exe
PID 916 wrote to memory of 4264	916	cmd.exe	[email protected]
PID 916 wrote to memory of 4264	916	cmd.exe	[email protected]
PID 916 wrote to memory of 4264	916	cmd.exe	[email protected]

C:\Users\Admin\AppData\Local\Temp\1dabf4e2be0ea69badcd37fee475fa06800e7a3bbc379bc1c94bd8f4df7ae3e1.exe
"C:\Users\Admin\AppData\Local\Temp\1dabf4e2be0ea69badcd37fee475fa06800e7a3bbc379bc1c94bd8f4df7ae3e1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:916
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:4264

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
ee2ff8ed79ec20657b68d1084fc479b9

SHA1
be1e4df74a9826ac21d7c081ebdb4fd527492898

SHA256
ea9337d50159d3622462c26346f699e6b355a12aefab326c7283187ceb444912

SHA512
bfed27f14be6c3c8bf3b1172322e8fc1c1d9da3b8ddc16067fecadf62dd0272a4e6f5d8c01f5feded0a30de92e50c9d8a9388129911a149be21ec0074a3d5063

Download Submit
memory/4264-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4912-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download