f65904bf96550c35c0d4a8f0fc89fd0601cf6826f0583c203c3a33dd39809c3f

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 04:56

Target

f65904bf96550c35c0d4a8f0fc89fd0601cf6826f0583c203c3a33dd39809c3f.exe
Size

79KB
MD5

0e812f9462c0b09d4249fae6e9895f6e
SHA1

75600af393733db27662545376d4630cd63d088e
SHA256

f65904bf96550c35c0d4a8f0fc89fd0601cf6826f0583c203c3a33dd39809c3f
SHA512

214fab4d1adee34da9e596206ca519300fe665ab114031ade08b4af097fb0092706463c0812a494300ec1cc83a3e4fdb93afea42f608b19c6dd79a0137aab7be
SSDEEP

1536:zvWqMuH9dwOQA8AkqUhMb2nuy5wgIP0CSJ+5yvB8GMGlZ5G:zvWqMutGdqU7uy5w9WMyvN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3436	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 3160	1900	f65904bf96550c35c0d4a8f0fc89fd0601cf6826f0583c203c3a33dd39809c3f.exe	93
PID 1900 wrote to memory of 3160	1900	f65904bf96550c35c0d4a8f0fc89fd0601cf6826f0583c203c3a33dd39809c3f.exe	93
PID 1900 wrote to memory of 3160	1900	f65904bf96550c35c0d4a8f0fc89fd0601cf6826f0583c203c3a33dd39809c3f.exe	93
PID 3160 wrote to memory of 3436	3160	cmd.exe	94
PID 3160 wrote to memory of 3436	3160	cmd.exe	94
PID 3160 wrote to memory of 3436	3160	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\f65904bf96550c35c0d4a8f0fc89fd0601cf6826f0583c203c3a33dd39809c3f.exe
"C:\Users\Admin\AppData\Local\Temp\f65904bf96550c35c0d4a8f0fc89fd0601cf6826f0583c203c3a33dd39809c3f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3160
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:3436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3696 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:4840

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
8d77527814fd938d993fd5bc1f09d946

SHA1
4aaccab757517f2b90506b729b206205ca94c1e2

SHA256
e82d7884649e65265b800c2a6ac856e079742d916f5b506a0774f4f21ebe7bcd

SHA512
b4970d44c2d4009fef40677deebb0260ee3ac8017b620ebc103ce4f795329ca39108e147ada821670c409541f28815b3c973fbfc45d475becaf470d6f4086511

Download Submit
memory/1900-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3436-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download