effe20c99531f18ba413f3220992dffe459def60cbe00321d18245e78fe1f711

Analysis

max time kernel
143s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 04:06

Target

cs_16_clean_eng.exe
Size

224.8MB
MD5

dbaf7f5ad00ac36634157fea521b06b8
SHA1

197cd6425b75b7b6b7d98ab2e1b78ebfa1fdabb4
SHA256

effe20c99531f18ba413f3220992dffe459def60cbe00321d18245e78fe1f711
SHA512

6c038d6285a0c9b4324be4c8b3bb1915bb759ccb255a107e74d491f15df48f52b99655b13ae58d36a59ab5b30653e8841ee7c9012622b25b55fb33f625578632
SSDEEP

6291456:7eNxaHTe03fXiH4Mm2T9wxP2LSbL9CgPmyfOfefmbH:7eNxaHT93Tm9wxeLSn9dPmpBj

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1176	cs_16_clean_eng.tmp

Loads dropped DLL 1 IoCs

pid	Process
1176	cs_16_clean_eng.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 1176	2080	cs_16_clean_eng.exe	85
PID 2080 wrote to memory of 1176	2080	cs_16_clean_eng.exe	85
PID 2080 wrote to memory of 1176	2080	cs_16_clean_eng.exe	85

C:\Users\Admin\AppData\Local\Temp\cs_16_clean_eng.exe
"C:\Users\Admin\AppData\Local\Temp\cs_16_clean_eng.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Users\Admin\AppData\Local\Temp\is-0MDLF.tmp\cs_16_clean_eng.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-0MDLF.tmp\cs_16_clean_eng.tmp" /SL5="$900B2,234481595,908800,C:\Users\Admin\AppData\Local\Temp\cs_16_clean_eng.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1176

C:\Users\Admin\AppData\Local\Temp\is-0MDLF.tmp\cs_16_clean_eng.tmp

Filesize
3.0MB

MD5
57d1f48aeeefaeb4c622162430671ea1

SHA1
92f94cc025811c8b91c157f14ec424a71aa59d79

SHA256
2ee19a5ed90da62affb9a3450a5711829ceff4b2fa9af902e12eec64f703ee5b

SHA512
a7688eb9bb61daeacd4f372ea484b0ab98a1745c4bd260c12b0847f7c7bb73a669dd42d073b0e0452fb46acde14e6ef676c52eaa6e489ebf21af9c8d8fdb357c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-A4B0J.tmp\idp.dll

Filesize
232KB

MD5
55c310c0319260d798757557ab3bf636

SHA1
0892eb7ed31d8bb20a56c6835990749011a2d8de

SHA256
54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed

SHA512
e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57

Download Submit
memory/1176-6-0x0000000000400000-0x000000000070D000-memory.dmp

Filesize
3.1MB

Download
memory/1176-13-0x0000000000400000-0x000000000070D000-memory.dmp

Filesize
3.1MB

Download
memory/2080-0-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download
memory/2080-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/2080-12-0x0000000000400000-0x00000000004EB000-memory.dmp

Filesize
940KB

Download