68b8e9b0959fe5da8fef1736d86bc316e0f50f0a613bcb43280a34170ba6d596

Analysis

max time kernel
92s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 22:19

Target

68b8e9b0959fe5da8fef1736d86bc316e0f50f0a613bcb43280a34170ba6d596.exe
Size

7.8MB
MD5

1b9434c7e2580c42d80874da365a4e08
SHA1

0c66b6c725ef7fae97162cc99817e691f90fb7cc
SHA256

68b8e9b0959fe5da8fef1736d86bc316e0f50f0a613bcb43280a34170ba6d596
SHA512

442bfa12bc9b06eb7520294190268226ffa3029938014e4163ca01c19afa778f5d80bdaf4854bf5e66ab3d1abeacb02d80f4088ca8d3ac8ff4d5bafecc8f55a6
SSDEEP

98304:emhd1Urye2WITMDKYjAo6AtprV7wQqZUha5jtSyZIUb:elJIImu6+r2QbaZtli

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3692	88F6.tmp

Executes dropped EXE 1 IoCs

pid	Process
3692	88F6.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 3692	2600	68b8e9b0959fe5da8fef1736d86bc316e0f50f0a613bcb43280a34170ba6d596.exe	83
PID 2600 wrote to memory of 3692	2600	68b8e9b0959fe5da8fef1736d86bc316e0f50f0a613bcb43280a34170ba6d596.exe	83
PID 2600 wrote to memory of 3692	2600	68b8e9b0959fe5da8fef1736d86bc316e0f50f0a613bcb43280a34170ba6d596.exe	83

C:\Users\Admin\AppData\Local\Temp\68b8e9b0959fe5da8fef1736d86bc316e0f50f0a613bcb43280a34170ba6d596.exe
"C:\Users\Admin\AppData\Local\Temp\68b8e9b0959fe5da8fef1736d86bc316e0f50f0a613bcb43280a34170ba6d596.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Users\Admin\AppData\Local\Temp\88F6.tmp
  "C:\Users\Admin\AppData\Local\Temp\88F6.tmp" --splashC:\Users\Admin\AppData\Local\Temp\68b8e9b0959fe5da8fef1736d86bc316e0f50f0a613bcb43280a34170ba6d596.exe 69202BF3B59774BA816DE6488EBD560D28AFCF37DD1BEC243785AB5E7DC9D06266AAEF29C1304AA502E81BC600650C870B97338AC22DA70392B4AA473988ACB7
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3692

C:\Users\Admin\AppData\Local\Temp\88F6.tmp

Filesize
7.8MB

MD5
dab6a37944ebe717c68f711481473882

SHA1
449dc3709fd885883a59121d7106e7ef5433f536

SHA256
743126ee93fedbaf09c329cc34bf6276912344f31220b5c1b6bd0c741b3bfc07

SHA512
6e1e18c81d597411491be661215238e744480b9fa8346f35dfa1d35e27c10b91e679945783bfda1918d472cb064a6afc8eb5763a29748a7d6f0e68d3778a3e33

Download Submit
memory/2600-0-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download
memory/3692-5-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download