d28f6bd8f8b992f1cdc1369347821ea51630621d6cac34401a32bd8c8f3d3c79

Analysis

max time kernel
134s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 03:09

Target

d28f6bd8f8b992f1cdc1369347821ea51630621d6cac34401a32bd8c8f3d3c79.exe
Size

6.0MB
MD5

2901d6b003669c0719adbc2df864595e
SHA1

210e5e08ccf5918abe897b1438ae528cdfcbdd0e
SHA256

d28f6bd8f8b992f1cdc1369347821ea51630621d6cac34401a32bd8c8f3d3c79
SHA512

3775f06e4211ba2576725ff9011c2a3d38bc74ca22b53f2478c6e79ce4134c73fa2818ea5a79b4a8b4769c7189e4dda78b2429513d439e11fa92e7a36d870bb5
SSDEEP

98304:emhd1Urye9pi1Df+j0vM9aLKPV7wQqZUha5jtSyZIUS:elSvVLKP2QbaZtlir

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2920	F0B9.tmp

Executes dropped EXE 1 IoCs

pid	Process
2920	F0B9.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 2920	1328	d28f6bd8f8b992f1cdc1369347821ea51630621d6cac34401a32bd8c8f3d3c79.exe	94
PID 1328 wrote to memory of 2920	1328	d28f6bd8f8b992f1cdc1369347821ea51630621d6cac34401a32bd8c8f3d3c79.exe	94
PID 1328 wrote to memory of 2920	1328	d28f6bd8f8b992f1cdc1369347821ea51630621d6cac34401a32bd8c8f3d3c79.exe	94

C:\Users\Admin\AppData\Local\Temp\d28f6bd8f8b992f1cdc1369347821ea51630621d6cac34401a32bd8c8f3d3c79.exe
"C:\Users\Admin\AppData\Local\Temp\d28f6bd8f8b992f1cdc1369347821ea51630621d6cac34401a32bd8c8f3d3c79.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Users\Admin\AppData\Local\Temp\F0B9.tmp
  "C:\Users\Admin\AppData\Local\Temp\F0B9.tmp" --splashC:\Users\Admin\AppData\Local\Temp\d28f6bd8f8b992f1cdc1369347821ea51630621d6cac34401a32bd8c8f3d3c79.exe 4E5CB77A6BA9BF496C1661CB593F0193B89BA7E7AA1928D99EFC6A6842800CE95756776365E2CEC9854A38E06EF64B3397D461E919356EF101DC46DD4D4888B6
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4028,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:8
1⤵
PID:4852

C:\Users\Admin\AppData\Local\Temp\F0B9.tmp

Filesize
6.0MB

MD5
2cd6a949d2da95bd7c6dede1c64b4c1b

SHA1
3fb2310723b57ec03ec1e81ef0dacb2977f9dea2

SHA256
9381adf9e03095e806083a6c3f836ac233577f8aa7e3689caa23701c52976ac0

SHA512
25a57cf0aa49ddefd901f9866da93c49c47ddd968867eb2e495cf8740cd7d84e5a06f895bdc171619d902bce04ed48f0c4ee105c9f8da176893421377a144652

Download Submit
memory/1328-0-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download
memory/2920-5-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download