3481176f20fca8edcf7723265e3f1b53712a42ed8bd2f18a2fd092d532048e6d

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 20:17

Target
3481176f20fca8edcf7723265e3f1b53712a42ed8bd2f18a2fd092d532048e6d.exe
Size 32KB
Sample240528-y2vbjaaf5s
SHA256 3481176f20fca8edcf7723265e3f1b53712a42ed8bd2f18a2fd092d532048e6d
MD5 4026f54f29dd554941f04b55555ce8ff
SHA1 cafb48b0c179c73137d5dc2dc2a9b446404b274e
SHA512 23570ed21165a294337da00e80ea9e55ef5d38951dbd6acb34e5334506208a977fdbb94d32bee5d7650fb3e28bd86b33bb5cfeb52a95bc91cea033c2afd97606
SSDEEP 384:c3//2DmnWRgcf6Oo3L1tGaygYCNXrqGKfMwzyZrzj8p:aKJ1uB5hNbkfZzu8p
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3980	emmpp.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 3980	3816	3481176f20fca8edcf7723265e3f1b53712a42ed8bd2f18a2fd092d532048e6d.exe	81
PID 3816 wrote to memory of 3980	3816	3481176f20fca8edcf7723265e3f1b53712a42ed8bd2f18a2fd092d532048e6d.exe	81
PID 3816 wrote to memory of 3980	3816	3481176f20fca8edcf7723265e3f1b53712a42ed8bd2f18a2fd092d532048e6d.exe	81

C:\Users\Admin\AppData\Local\Temp\3481176f20fca8edcf7723265e3f1b53712a42ed8bd2f18a2fd092d532048e6d.exe
"C:\Users\Admin\AppData\Local\Temp\3481176f20fca8edcf7723265e3f1b53712a42ed8bd2f18a2fd092d532048e6d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Users\Admin\AppData\Local\Temp\emmpp.exe
  C:\Users\Admin\AppData\Local\Temp\emmpp.exe
  2⤵
  - Executes dropped EXE
  PID:3980

emmpp.exe

Path C:\Users\Admin\AppData\Local\Temp\emmpp.exe
Size 32KB
SHA256 fcc22ba09b04310aecddc5a48847efbc60d427c1df4455fef01ea8b5403b0b42
MD5 65dc16b980a5a388badec6ece666402a
SHA1 9cf58fe58b34bc88ad7c92e371d4518cec8f3133
SHA512 86ff1c2f403b0f9e321f5a8d96e7da6d9b7f19e8042f5282abbfb91f3496a2583ef5b5fabce66ceb069d7afba36e80d9a0650b975fd5349b79f7f5acbcfecf1e
SSDEEP 384:c3//2DmnWRgcf6Oo3L1tGaygYCNXrqGKfMwzyZrzj8y:aKJ1uB5hNbkfZzu8y
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3816-2-0x0000000000401000-0x0000000000403000-memory.dmp

Download

memory/3980-5-0x0000000000400000-0x0000000000408000-memory.dmp

Download