02e40f560d5fd4b6869aecd06a2f61a8b06d396b4f75db8d92cc7d7291b2d44a

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 18:15

Target

02e40f560d5fd4b6869aecd06a2f61a8b06d396b4f75db8d92cc7d7291b2d44a.exe
Size

7.5MB
MD5

21d4206468be0051cc5ff4fb62877663
SHA1

04bdc5844cfea502f9c7ada4fa30de20d09ed245
SHA256

02e40f560d5fd4b6869aecd06a2f61a8b06d396b4f75db8d92cc7d7291b2d44a
SHA512

ce83be5c1d8f7700ecc467597304d966ce382dd56b7ac59d3b5890191045be4e19dd3d81ff034dd8d04894531af077d5299be706cbf1745fdcba52a902a204c6
SSDEEP

98304:emhd1Urye4OfLvJaj0D8LUDh0V7wQqZUha5jtSyZIUbQ:elnDnA2QbaZtlix

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4012	44BA.tmp

Executes dropped EXE 1 IoCs

pid	Process
4012	44BA.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 4012	916	02e40f560d5fd4b6869aecd06a2f61a8b06d396b4f75db8d92cc7d7291b2d44a.exe	85
PID 916 wrote to memory of 4012	916	02e40f560d5fd4b6869aecd06a2f61a8b06d396b4f75db8d92cc7d7291b2d44a.exe	85
PID 916 wrote to memory of 4012	916	02e40f560d5fd4b6869aecd06a2f61a8b06d396b4f75db8d92cc7d7291b2d44a.exe	85

C:\Users\Admin\AppData\Local\Temp\02e40f560d5fd4b6869aecd06a2f61a8b06d396b4f75db8d92cc7d7291b2d44a.exe
"C:\Users\Admin\AppData\Local\Temp\02e40f560d5fd4b6869aecd06a2f61a8b06d396b4f75db8d92cc7d7291b2d44a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:916
- C:\Users\Admin\AppData\Local\Temp\44BA.tmp
  "C:\Users\Admin\AppData\Local\Temp\44BA.tmp" --splashC:\Users\Admin\AppData\Local\Temp\02e40f560d5fd4b6869aecd06a2f61a8b06d396b4f75db8d92cc7d7291b2d44a.exe 7D353F3ECD5097161F14CB9342932121184E0139A75AB39EC1FFE9485EF53AA7DBE66E142AB592F3356E9FB06AA9C41DE7B6C7AE6E6F15C2DE59992980C0E15C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4012

C:\Users\Admin\AppData\Local\Temp\44BA.tmp

Filesize
7.5MB

MD5
22e206af89931fa1f320e0b42c440137

SHA1
bf4b7c25612836db5f72a31e4a96471d677d2cae

SHA256
93fd83fd87425ab89e52897ead37ec740773a3de9aba6f4547dd7b3b1f41278a

SHA512
cc6c5e3b7c1a0c9aaf57da016e6f3e8b6a1316d61c54be9c4a890cec795d1a18be3a52eb89ed8f3f54e5786b8098282035893e18899a8209433aea7acae22009

Download Submit
memory/916-0-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download
memory/4012-5-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download