d0dd0fd94bf0cf78bd9613749dfee32eac544c84078c4569d3608c07306d9dcc

Analysis

max time kernel
141s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 01:54

Target

6899c281ee35c7222658afb974ae090b.exe
Size

1.7MB
MD5

6899c281ee35c7222658afb974ae090b
SHA1

9f3e90859a59f41b7ae36e4f1736994da0005232
SHA256

d0dd0fd94bf0cf78bd9613749dfee32eac544c84078c4569d3608c07306d9dcc
SHA512

0689fa19895ec965c8a4b6590f77326c683ddb6ae6dcca892c6130c4ee19e65762ecf9e64a6a57a12bf992a43d279e97f16aaa9a76ad54d4ab5be988913722c1
SSDEEP

24576:57FUDowAyrTVE3U5FKFkZqheAarKYvwLlI4YF/HgPpSLlYzs/b/dIU9Mb:5BuZrEUhrKmqI4Y19leszWUc

Score

4^/10

Executes dropped EXE 1 IoCs

pid	Process
1516	6899c281ee35c7222658afb974ae090b.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 1516	4316	6899c281ee35c7222658afb974ae090b.exe	81
PID 4316 wrote to memory of 1516	4316	6899c281ee35c7222658afb974ae090b.exe	81
PID 4316 wrote to memory of 1516	4316	6899c281ee35c7222658afb974ae090b.exe	81

C:\Users\Admin\AppData\Local\Temp\6899c281ee35c7222658afb974ae090b.exe
"C:\Users\Admin\AppData\Local\Temp\6899c281ee35c7222658afb974ae090b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Users\Admin\AppData\Local\Temp\is-FF3FF.tmp\6899c281ee35c7222658afb974ae090b.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-FF3FF.tmp\6899c281ee35c7222658afb974ae090b.tmp" /SL5="$E0056,840718,816128,C:\Users\Admin\AppData\Local\Temp\6899c281ee35c7222658afb974ae090b.exe"
  2⤵
  - Executes dropped EXE
  PID:1516

C:\Users\Admin\AppData\Local\Temp\is-FF3FF.tmp\6899c281ee35c7222658afb974ae090b.tmp

Filesize
3.0MB

MD5
4871293a9b086b2d7a1cfc949e16693d

SHA1
6201aecb1e0cad8bff061ad6b04d9cf112957236

SHA256
4ffeeddd46fef8aa76e92ef5504fda6efc7c8185959daa512b14f043956155fb

SHA512
e55bede0fffdc3244e99dfb13aaca11cddf1c8e97285b767ae66334ea652d504c64561f4c0257afc3cff91c1113d8f84e034d242855e17b65cdd27021c3a41a0

Download Submit
memory/1516-6-0x0000000000400000-0x000000000070F000-memory.dmp

Filesize
3.1MB

Download
memory/1516-9-0x0000000000400000-0x000000000070F000-memory.dmp

Filesize
3.1MB

Download
memory/1516-14-0x0000000000400000-0x000000000070F000-memory.dmp

Filesize
3.1MB

Download
memory/4316-0-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/4316-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/4316-8-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download