35c1adb6c50243f205b1af664d8b0d0c70856dbc5e294924f5d0bf78bcd4e602

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 02:10

Target
5700180fcf959ff6176876d087b08290.exe
Size 79KB
Sample240531-cl2j1sce97
SHA256 35c1adb6c50243f205b1af664d8b0d0c70856dbc5e294924f5d0bf78bcd4e602
MD5 5700180fcf959ff6176876d087b08290
SHA1 659261b8c1f07d23e96c0628bab94ae5318af580
SHA512 9bd57ac08c0e32ec33f1ef605c2d1f4fe9a46198b21cbd3cd8b1b5070df9d55b7d9223c116cb79f4440b6e727b227405a7f4ce3bed1b8a1542161ea203421285
SSDEEP 1536:zvlhoiHiPFWDJOQA8AkqUhMb2nuy5wgIP0CSJ+5yxB8GMGlZ5G:zvVCd/GdqU7uy5w9WMyxN5G
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4772	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 660 wrote to memory of 4776	660	5700180fcf959ff6176876d087b08290.exe	84
PID 660 wrote to memory of 4776	660	5700180fcf959ff6176876d087b08290.exe	84
PID 660 wrote to memory of 4776	660	5700180fcf959ff6176876d087b08290.exe	84
PID 4776 wrote to memory of 4772	4776	cmd.exe	85
PID 4776 wrote to memory of 4772	4776	cmd.exe	85
PID 4776 wrote to memory of 4772	4776	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\5700180fcf959ff6176876d087b08290.exe
"C:\Users\Admin\AppData\Local\Temp\5700180fcf959ff6176876d087b08290.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:660
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:4772

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 79KB
SHA256 0f623867712bd227b6c4649e27d51fe2aae8d98abca532f5d082b68295e86e86
MD5 ff5062145e2a21294af77577ee1cc814
SHA1 b95e70deb316868f8c5e8fe5def338a72f85e294
SHA512 2bc642ffce2117e3d66020983357ec3a3d27942ea1e76fc1d34dbefeaae3d64c9150192fb04f0bbeb2485749da0112b248cb5aad8042d0c1571e11f55a2cb9fb
SSDEEP 1536:zv+vF0ocOQA8AkqUhMb2nuy5wgIP0CSJ+5yLB8GMGlZ5G:zv+vTpGdqU7uy5w9WMyLN5G
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/660-6-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4772-5-0x0000000000400000-0x000000000041B000-memory.dmp

Download