cf368c99f74d6ee88e18273a2fc82e4254c8192a4894cf976f0f63b57b5a6625

Analysis

max time kernel
141s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 04:26

Target
cf368c99f74d6ee88e18273a2fc82e4254c8192a4894cf976f0f63b57b5a6625.exe
Size 748KB
Sample240612-e2syxs1bpn
SHA256 cf368c99f74d6ee88e18273a2fc82e4254c8192a4894cf976f0f63b57b5a6625
MD5 7a7a4ed450a202f80b346e5191d83587
SHA1 d55c677b09c01e4258d4239fb5981576563decd6
SHA512 23b1ec600e31fb31b8fe43c94ea97d3180463c12e23a329929f4efdea6ad30ec3be3dcc2c0dd9ef06518de30c1c8b6b83fd7464078064317dd4340768ce1d4f7
SSDEEP 12288:uaHc64b888888888888W88888888888hoscV7/9GqeMo3NM5o7jQp3z33rD+zG/F:F86wjW7/9oNT7cp7ezG/aYFkJR30F6ru
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2252	cf368c99f74d6ee88e18273a2fc82e4254c8192a4894cf976f0f63b57b5a6625.tmp

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	10	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 2252	800	cf368c99f74d6ee88e18273a2fc82e4254c8192a4894cf976f0f63b57b5a6625.exe	79
PID 800 wrote to memory of 2252	800	cf368c99f74d6ee88e18273a2fc82e4254c8192a4894cf976f0f63b57b5a6625.exe	79
PID 800 wrote to memory of 2252	800	cf368c99f74d6ee88e18273a2fc82e4254c8192a4894cf976f0f63b57b5a6625.exe	79

C:\Users\Admin\AppData\Local\Temp\cf368c99f74d6ee88e18273a2fc82e4254c8192a4894cf976f0f63b57b5a6625.exe
"C:\Users\Admin\AppData\Local\Temp\cf368c99f74d6ee88e18273a2fc82e4254c8192a4894cf976f0f63b57b5a6625.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:800
- C:\Users\Admin\AppData\Local\Temp\is-75478.tmp\cf368c99f74d6ee88e18273a2fc82e4254c8192a4894cf976f0f63b57b5a6625.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-75478.tmp\cf368c99f74d6ee88e18273a2fc82e4254c8192a4894cf976f0f63b57b5a6625.tmp" /SL5="$D0052,372526,121344,C:\Users\Admin\AppData\Local\Temp\cf368c99f74d6ee88e18273a2fc82e4254c8192a4894cf976f0f63b57b5a6625.exe"
  2⤵
  - Executes dropped EXE
  PID:2252

cf368c99f74d6ee88e18273a2fc82e4254c8192a4894cf976f0f63b57b5a6625.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-75478.tmp\cf368c99f74d6ee88e18273a2fc82e4254c8192a4894cf976f0f63b57b5a6625.tmp
Size 1.1MB
SHA256 9c81817acd4982632d8c7f1df3898fca1477577738184265d735f49fc5480f07
MD5 34acc2bdb45a9c436181426828c4cb49
SHA1 5adaa1ac822e6128b8d4b59a54d19901880452ae
SHA512 134ff4022571efd46f7a62e99b857ebe834e9916c786345908010f9e1fb90be226b740ddee16ae9290fe45c86be7238c4555e422abe66a461d11545e19734beb
SSDEEP 24576:/nbbPImgK4brDi4IxgRqzwqNb+Yz73P2EMZbG0JEtdqxyt:/HeKh4nqzF3PYdSto
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/800-1-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/800-2-0x0000000000401000-0x0000000000412000-memory.dmp

Download

memory/800-8-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2252-6-0x0000000000400000-0x000000000052E000-memory.dmp

Download

memory/2252-9-0x0000000000400000-0x000000000052E000-memory.dmp

Download