cccc1b14cb1782fb5b67c6de575f5b3e03a42658c5756e9ab9bb7de94aef3975

Analysis

max time kernel
144s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 07:04

Target

cccc1b14cb1782fb5b67c6de575f5b3e03a42658c5756e9ab9bb7de94aef3975.exe
Size

13KB
MD5

a9b938c11310e85c6e0c0c1e90dfd5ae
SHA1

2fec379f5e0c9ce4d8eb478ef99ad7d17ed07d90
SHA256

cccc1b14cb1782fb5b67c6de575f5b3e03a42658c5756e9ab9bb7de94aef3975
SHA512

7c64ced96f041475d0c90a761b5f4b60ab7f5e0a2180af7ab76dc83e695d1e044584f6ec21f92f0ef8b3fc617b19b26614f1fd38b72ca5fb207640eb0628ae88
SSDEEP

192:E3bI1Ut1hrT/62ri5TrKiuXOKzVTBP+rF/XvU0mNX+iKl+7jOeWlJdxqHw1x:E31VTmVudpkhOvE+XWlJj+6

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
3060	242607070409408.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 4516	1428	cccc1b14cb1782fb5b67c6de575f5b3e03a42658c5756e9ab9bb7de94aef3975.exe	104
PID 1428 wrote to memory of 4516	1428	cccc1b14cb1782fb5b67c6de575f5b3e03a42658c5756e9ab9bb7de94aef3975.exe	104
PID 4516 wrote to memory of 3060	4516	cmd.exe	105
PID 4516 wrote to memory of 3060	4516	cmd.exe	105

C:\Users\Admin\AppData\Local\Temp\cccc1b14cb1782fb5b67c6de575f5b3e03a42658c5756e9ab9bb7de94aef3975.exe
"C:\Users\Admin\AppData\Local\Temp\cccc1b14cb1782fb5b67c6de575f5b3e03a42658c5756e9ab9bb7de94aef3975.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\242607070409408.exe 000001
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Users\Admin\AppData\Local\Temp\242607070409408.exe
    C:\Users\Admin\AppData\Local\Temp\242607070409408.exe 000001
    3⤵
    - Executes dropped EXE
    PID:3060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4180,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
1⤵
PID:3420

C:\Users\Admin\AppData\Local\Temp\242607070409408.exe

Filesize
12KB

MD5
108d26b530d5024c132f6d9526bfbbef

SHA1
70e3363e11807a11542d9bf0515b3fddb8481e18

SHA256
c48b6a1959e70c90f064fe670d2253885441a857ed6667db1647a654cfd3c1dd

SHA512
2395c7256ac18f8f28988eade92cffe8044a2cd3e8ab7411310105806ca8c2271bd824186ded5c468c24a5204d6ae415f6ef72efbfb2613d8ef6b8694b81e83b

Download Submit