4aa087520aedc2a3738613988631a85c2db89408d8da4f24bf46be74457f8083

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 12:59

Target

4aa087520aedc2a3738613988631a85c2db89408d8da4f24bf46be74457f8083.exe
Size

7.8MB
MD5

44b2b48c3729f8435cf18f0e98a06e4e
SHA1

b5adfc5cfcf89f66c9b0abe8a1826731fa5e24f6
SHA256

4aa087520aedc2a3738613988631a85c2db89408d8da4f24bf46be74457f8083
SHA512

c955e35aee0844b1fc410f4c53e36f1f0d0e3e87845784ad0f7fc8f9786313e5e88a1889bde458ca8d0cb0eb4bde97d75a20c25374b5f5874d479f37a7fc56a4
SSDEEP

98304:emhd1Uryes1nrMis71O3SeyK8dV7wQqZUha5jtSyZIUb:elM1rts71Od8d2QbaZtli

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2380	421A.tmp

Executes dropped EXE 1 IoCs

pid	Process
2380	421A.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 2380	4296	4aa087520aedc2a3738613988631a85c2db89408d8da4f24bf46be74457f8083.exe	85
PID 4296 wrote to memory of 2380	4296	4aa087520aedc2a3738613988631a85c2db89408d8da4f24bf46be74457f8083.exe	85
PID 4296 wrote to memory of 2380	4296	4aa087520aedc2a3738613988631a85c2db89408d8da4f24bf46be74457f8083.exe	85

C:\Users\Admin\AppData\Local\Temp\4aa087520aedc2a3738613988631a85c2db89408d8da4f24bf46be74457f8083.exe
"C:\Users\Admin\AppData\Local\Temp\4aa087520aedc2a3738613988631a85c2db89408d8da4f24bf46be74457f8083.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Users\Admin\AppData\Local\Temp\421A.tmp
  "C:\Users\Admin\AppData\Local\Temp\421A.tmp" --splashC:\Users\Admin\AppData\Local\Temp\4aa087520aedc2a3738613988631a85c2db89408d8da4f24bf46be74457f8083.exe CDFC13375DBED68A492C633E0E3C73D4EFB522985354914CD165F5BBF2848A756660ED6BC10F22FC9CE502E9E7C7D2624AE6380723B965D639C238C3369197A7
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2380

C:\Users\Admin\AppData\Local\Temp\421A.tmp

Filesize
7.8MB

MD5
742f0b8f080980a9f87bff5fb94d9698

SHA1
26265ee4f6834dccef01e9e4b2d51a14274c4a28

SHA256
48fec8efdcb64ed1178405d385d9304a05a50bb99c11935b31a827f31d39a8bb

SHA512
56a9c9f1ba0b53c9a4b005cb4bd2c731b9c6f973705ef8057c5442466a6f9e77ab723dc30a67b315470fed8b06eee0aee38788d3aff9c8c51a2fa802ff392119

Download Submit
memory/2380-5-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download
memory/4296-0-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download