01df46ee19ba2ba5139156ed8168530f038d9258f708f079bf2321c4287032ba

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 18:09

Target

01df46ee19ba2ba5139156ed8168530f038d9258f708f079bf2321c4287032ba.exe
Size

6.0MB
MD5

df060fa1673bf443f619358852678bd7
SHA1

54e14af8ed944bfbc76492186530bf9a743504f1
SHA256

01df46ee19ba2ba5139156ed8168530f038d9258f708f079bf2321c4287032ba
SHA512

1d80a41312204c583e09214d8f4890fd3137090ff1680f59871d39f2483ba68764de2719d09169a592521d24b95deae5ec24df50abe1218adbe99a20c3e58c88
SSDEEP

98304:emhd1UryeDc272cVCafWYpxNV7wQqZUha5jtSyZIUS:eljc2qy4exN2QbaZtlir

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2400	47A8.tmp

Executes dropped EXE 1 IoCs

pid	Process
2400	47A8.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2400	2968	01df46ee19ba2ba5139156ed8168530f038d9258f708f079bf2321c4287032ba.exe	81
PID 2968 wrote to memory of 2400	2968	01df46ee19ba2ba5139156ed8168530f038d9258f708f079bf2321c4287032ba.exe	81
PID 2968 wrote to memory of 2400	2968	01df46ee19ba2ba5139156ed8168530f038d9258f708f079bf2321c4287032ba.exe	81

C:\Users\Admin\AppData\Local\Temp\01df46ee19ba2ba5139156ed8168530f038d9258f708f079bf2321c4287032ba.exe
"C:\Users\Admin\AppData\Local\Temp\01df46ee19ba2ba5139156ed8168530f038d9258f708f079bf2321c4287032ba.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Users\Admin\AppData\Local\Temp\47A8.tmp
  "C:\Users\Admin\AppData\Local\Temp\47A8.tmp" --splashC:\Users\Admin\AppData\Local\Temp\01df46ee19ba2ba5139156ed8168530f038d9258f708f079bf2321c4287032ba.exe FB3573E4BE4C5BE44EE39743A3B80A27B6655A17A2EB809152EF936FFFAE899851AF41C4A52918A781D345688E7FFC5873EEAE7D677CAB5D312FEB93C8E3433C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2400

C:\Users\Admin\AppData\Local\Temp\47A8.tmp

Filesize
6.0MB

MD5
d045d081090fd1d03982f8e7f0491e3a

SHA1
a6b97daf5464fbf6f11648f1b030b8e241fbc397

SHA256
54045b3a2ce142818751c4bb067086249aac4fd9c1f5f616c07177470c124749

SHA512
993573c541e035c95546a78c3c86debb414f2e19642fbbeb0cd2d6c63c895daef1b1ec41ec46a21def31a61af05feebcb9f9424751087eab397b18511a317949

Download Submit
memory/2400-5-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download
memory/2968-0-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download