cf8522530e59e7979ee494305dbcb1b8d296f478ac77cc0c86590d7078b20f1f

Analysis

max time kernel
149s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 04:27

Target
cf8522530e59e7979ee494305dbcb1b8d296f478ac77cc0c86590d7078b20f1f.exe
Size 29KB
Sample240612-e26vsa1bqk
SHA256 cf8522530e59e7979ee494305dbcb1b8d296f478ac77cc0c86590d7078b20f1f
MD5 a2b710d6fdee3eec4b1bb929e9afb1aa
SHA1 f98eb3944379205ad9820384e8b0953f549cc248
SHA512 59cc25cf51c9f7abe9acd68d6ac5c10f8864aa206204e760792d73435cf7d2cc5a4cb1161cb8c7d66a274940bf791f06334fae41437fb320d40eb4c17f59d9dd
SSDEEP 384:v/4LNJY74JwOllSBQmrb0i5PrmqHIKpa54b5f0iws0wGF45:v/qSamrxDmqoKM4Z0iwtwc45
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
208	2024061204.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2012	cf8522530e59e7979ee494305dbcb1b8d296f478ac77cc0c86590d7078b20f1f.exe
208	2024061204.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 208	2012	cf8522530e59e7979ee494305dbcb1b8d296f478ac77cc0c86590d7078b20f1f.exe	81
PID 2012 wrote to memory of 208	2012	cf8522530e59e7979ee494305dbcb1b8d296f478ac77cc0c86590d7078b20f1f.exe	81
PID 2012 wrote to memory of 208	2012	cf8522530e59e7979ee494305dbcb1b8d296f478ac77cc0c86590d7078b20f1f.exe	81
PID 2012 wrote to memory of 2020	2012	cf8522530e59e7979ee494305dbcb1b8d296f478ac77cc0c86590d7078b20f1f.exe	83
PID 2012 wrote to memory of 2020	2012	cf8522530e59e7979ee494305dbcb1b8d296f478ac77cc0c86590d7078b20f1f.exe	83
PID 2012 wrote to memory of 2020	2012	cf8522530e59e7979ee494305dbcb1b8d296f478ac77cc0c86590d7078b20f1f.exe	83

C:\Users\Admin\AppData\Local\Temp\cf8522530e59e7979ee494305dbcb1b8d296f478ac77cc0c86590d7078b20f1f.exe
"C:\Users\Admin\AppData\Local\Temp\cf8522530e59e7979ee494305dbcb1b8d296f478ac77cc0c86590d7078b20f1f.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Users\Admin\AppData\Local\Temp\2024061204.exe
  C:\Users\Admin\AppData\Local\Temp\2024061204.exe down
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:208
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del.bat
  2⤵
  PID:2020

2024061204.exe

Path C:\Users\Admin\AppData\Local\Temp\2024061204.exe
Size 29KB
SHA256 1c52036335fa3539515caf95840efd838a425170587d86a0049c76a8c0ec629d
MD5 74b762fa77704203119244cfb3622aa1
SHA1 eca3c16750b55f12c39373785425d7bac8c82c99
SHA512 4de8884c4bfad8b87afb2995242edc1f7f14d73a783118b84d4b67b244639e3c79139274c60f63ef97fb4e94fa8e50c7c56623e4ab4ffd85a7562bd6affdadd7
SSDEEP 384:v/4LNJY74JwOllSBQmrb0i5PrmqHIKpa54b5f0iws0wGF4l:v/qSamrxDmqoKM4Z0iwtwc4l
MD5 SHA1 SHA512 SSDEEP

Submit Download

del.bat

Path C:\Users\Admin\AppData\Local\Temp\del.bat
Size 267B
SHA256 284e7c6a1264bb60eb1bc3a71e5d0c96a3dc04385a30985caccd720e1eb589a3
MD5 7f6ef99b64f36d1f04e21c9d30447e9d
SHA1 eb3592598746c909de43a1723d5e3d96f78c8bf6
SHA512 bf470fa2deb6a0a198c63e9b27ca59806d3e79eb17842af0d95e723cd4ab8d2e8ae8d4364b9c73b379fcc69bb9fe2a8004f730f94b25c425e62f204073760264
MD5 SHA1 SHA512

Submit Download

memory/208-14-0x0000000000400000-0x0000000000408000-memory.dmp

Download