48400bb4ce4dd278bdac47a12f648113af058de87ba6ccc1373dccb994bf8b9b

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 21:14

Target

48400bb4ce4dd278bdac47a12f648113af058de87ba6ccc1373dccb994bf8b9b.exe
Size

79KB
MD5

0922414f0d13a87fc1209a90e2094e3b
SHA1

c188b841b91a964f52123895809edd185e0c6fd5
SHA256

48400bb4ce4dd278bdac47a12f648113af058de87ba6ccc1373dccb994bf8b9b
SHA512

c87e37ad8c5d898c8f3d4cccebc4008fd16d824e7301cdbd4b56b7f1f9f91cb8307e0d1dbf0603215bb75cf0c35d9a5f07010e3aed3170981a7e9aca5a54faa4
SSDEEP

1536:zvutflb9x7eB1xqz4OQA8AkqUhMb2nuy5wgIP0CSJ+5yenB8GMGlZ5G:zvKtb99ebQpGdqU7uy5w9WMy8N5G

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

[email protected]

pid process

2880 [email protected]

pid	process
2880	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

48400bb4ce4dd278bdac47a12f648113af058de87ba6ccc1373dccb994bf8b9b.execmd.exe

description	pid	process	target process
PID 3052 wrote to memory of 1844	3052	48400bb4ce4dd278bdac47a12f648113af058de87ba6ccc1373dccb994bf8b9b.exe	cmd.exe
PID 3052 wrote to memory of 1844	3052	48400bb4ce4dd278bdac47a12f648113af058de87ba6ccc1373dccb994bf8b9b.exe	cmd.exe
PID 3052 wrote to memory of 1844	3052	48400bb4ce4dd278bdac47a12f648113af058de87ba6ccc1373dccb994bf8b9b.exe	cmd.exe
PID 1844 wrote to memory of 2880	1844	cmd.exe	[email protected]
PID 1844 wrote to memory of 2880	1844	cmd.exe	[email protected]
PID 1844 wrote to memory of 2880	1844	cmd.exe	[email protected]

C:\Users\Admin\AppData\Local\Temp\48400bb4ce4dd278bdac47a12f648113af058de87ba6ccc1373dccb994bf8b9b.exe
"C:\Users\Admin\AppData\Local\Temp\48400bb4ce4dd278bdac47a12f648113af058de87ba6ccc1373dccb994bf8b9b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1844
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2880

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
4c3c84829fba03a252eea93b3cd0ee6c

SHA1
09475a9127add03d50fbbe2da34e492cabe8c9ec

SHA256
848c83e6ae0e448c3095f658151d5c06c73f56a7f7295fee0813d2699506a4af

SHA512
effc88010ace27b0801ee4e72e1f9b11d9c448a2e41eb4e611ebd623c26ff4263bdf7e18490769d52822c2b9b33667661e6d20359514b9979f2c89f52a817fdd

Download Submit
memory/2880-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3052-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download