9c3e93dc65aed92fd0d19854eb95284a60ee3efddd9dcc212278d25e397643a9

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 00:17

Target

9c3e93dc65aed92fd0d19854eb95284a60ee3efddd9dcc212278d25e397643a9.exe
Size

566KB
MD5

9f330fbf2c451270d31e3cd3ed00784c
SHA1

c97c4c846c87792945f4151e63771a7105b9655c
SHA256

9c3e93dc65aed92fd0d19854eb95284a60ee3efddd9dcc212278d25e397643a9
SHA512

50c241d63207a72c177e64b38310b6c03e4a47458b090f2a76543aca7cdfee4332ad0439c2d3b48b7ae63c5d19a0280886633a4280dcc25fe8d9074b7bf060a7
SSDEEP

12288:IWBm+95nHfF2mgewFm5fFBCwmLLNC17k1kfgjdkA7YdfPgvF:IWBz95ndbgfm59wLNC17/gjT7YdfYvF

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3372	4D55.tmp

Executes dropped EXE 1 IoCs

pid	Process
3372	4D55.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 3372	1584	9c3e93dc65aed92fd0d19854eb95284a60ee3efddd9dcc212278d25e397643a9.exe	82
PID 1584 wrote to memory of 3372	1584	9c3e93dc65aed92fd0d19854eb95284a60ee3efddd9dcc212278d25e397643a9.exe	82
PID 1584 wrote to memory of 3372	1584	9c3e93dc65aed92fd0d19854eb95284a60ee3efddd9dcc212278d25e397643a9.exe	82

C:\Users\Admin\AppData\Local\Temp\9c3e93dc65aed92fd0d19854eb95284a60ee3efddd9dcc212278d25e397643a9.exe
"C:\Users\Admin\AppData\Local\Temp\9c3e93dc65aed92fd0d19854eb95284a60ee3efddd9dcc212278d25e397643a9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Users\Admin\AppData\Local\Temp\4D55.tmp
  "C:\Users\Admin\AppData\Local\Temp\4D55.tmp" --pingC:\Users\Admin\AppData\Local\Temp\9c3e93dc65aed92fd0d19854eb95284a60ee3efddd9dcc212278d25e397643a9.exe F2908B07805C3987DD9F3F3D53DDF56360922F90D36C612312538805207F997B8DB520776E8A363210DDB0C7D444EB1102ECB452D2514F22A827CF8B0423F084
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3372

C:\Users\Admin\AppData\Local\Temp\4D55.tmp

Filesize
566KB

MD5
87dac9600ae92faf9e2049be9b9b2c0b

SHA1
91fc92723dd87b9fe6be71f8e6f8bb746c3705eb

SHA256
b23f2cac34787b2e96a99fc07c3251a7201ab7806da82fcc61ec5f4ed3eb1d83

SHA512
6f411aabf9f24e3c5ea51ec6eec80274c512c3a827af75c0fcbf1ad25f03eeb0e2aae5b92c6e67d4fb5604049e9b889431ca4e99306356690e1b79a7417e4e23

Download Submit
memory/1584-0-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1584-7-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/3372-5-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/3372-6-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download