a778423f25636dde3c8a5afb3969d8d102622b15000800dbf1d1e34e5751a890

Analysis

max time kernel
92s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:29

Target

a778423f25636dde3c8a5afb3969d8d102622b15000800dbf1d1e34e5751a890.exe
Size

79KB
MD5

08e1e4dedecd46dc73392668bb336e79
SHA1

f64070c8d45453934f9e7db9b3152d1c4e109a54
SHA256

a778423f25636dde3c8a5afb3969d8d102622b15000800dbf1d1e34e5751a890
SHA512

c779c93a667806cbf91f725afe8d5c784c961841b59a0978eb10c0f9882aa934b580db2ef588e7c43aada05bc244877d4baef2686f9f483f03c91902a1c3717d
SSDEEP

1536:zvwM17sLxI8XRG5JoOQA8AkqUhMb2nuy5wgIP0CSJ+5y7B8GMGlZ5G:zvxALSdGdqU7uy5w9WMy7N5G

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

[email protected]

pid process

2660 [email protected]

pid	process
2660	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

a778423f25636dde3c8a5afb3969d8d102622b15000800dbf1d1e34e5751a890.execmd.exe

description	pid	process	target process
PID 1436 wrote to memory of 1440	1436	a778423f25636dde3c8a5afb3969d8d102622b15000800dbf1d1e34e5751a890.exe	cmd.exe
PID 1436 wrote to memory of 1440	1436	a778423f25636dde3c8a5afb3969d8d102622b15000800dbf1d1e34e5751a890.exe	cmd.exe
PID 1436 wrote to memory of 1440	1436	a778423f25636dde3c8a5afb3969d8d102622b15000800dbf1d1e34e5751a890.exe	cmd.exe
PID 1440 wrote to memory of 2660	1440	cmd.exe	[email protected]
PID 1440 wrote to memory of 2660	1440	cmd.exe	[email protected]
PID 1440 wrote to memory of 2660	1440	cmd.exe	[email protected]

C:\Users\Admin\AppData\Local\Temp\a778423f25636dde3c8a5afb3969d8d102622b15000800dbf1d1e34e5751a890.exe
"C:\Users\Admin\AppData\Local\Temp\a778423f25636dde3c8a5afb3969d8d102622b15000800dbf1d1e34e5751a890.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1436

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c [email protected]
2⤵
- Suspicious use of WriteProcessMemory
PID:1440

C:\Users\Admin\AppData\Local\Temp\[email protected]
[email protected]
3⤵
- Executes dropped EXE
PID:2660

C:\Users\Admin\AppData\Local\Temp\[email protected]
Filesize
79KB

MD5
6de75856a473de3cf5daec98a50d77d1

SHA1
d5aa157322f0606f724bb14414416b18799f9a74

SHA256
d42ed59895a71764f2d65e3ec8b0bca732e201b06b99862c2ec2d78e46765070

SHA512
b309a42c780328f444a0776386c5a604dd0a2da7513314467c222b282ed19a3e8282f6a07ff5982ebd7977c2e23c609c8118a32a2afcc3c423bdbbf05c4e306c

Download Submit
memory/1436-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2660-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download