40003d01db9c34da73a415792dba3a617fab65e91d2aae7bbbcd335af198a66b

Analysis

max time kernel
125s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-06-2024 09:08

Target

40003d01db9c34da73a415792dba3a617fab65e91d2aae7bbbcd335af198a66b.exe
Size

7.2MB
MD5

9606143c857bbfe1b1da8e3d1fa9ae0e
SHA1

cb3a1b1d8e6acbe46c96b5b159a7be2d372b3cc6
SHA256

40003d01db9c34da73a415792dba3a617fab65e91d2aae7bbbcd335af198a66b
SHA512

2e118c618265b8769b15dff8add661c60f17afd46365773ca22e359b03a765c83a7f316057045293a71b53a889771fadf54e6ac1ee3fd9b3a7437f266f8af08b
SSDEEP

196608:jeuNPzUCugRPeW7R9dGfqEjirb49GOD2MpkB:CmZB77R9d0q1A9GLM

Score

6^/10

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
34	ipinfo.io
33	ipinfo.io

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 1152	4412	40003d01db9c34da73a415792dba3a617fab65e91d2aae7bbbcd335af198a66b.exe	100
PID 4412 wrote to memory of 1152	4412	40003d01db9c34da73a415792dba3a617fab65e91d2aae7bbbcd335af198a66b.exe	100
PID 4412 wrote to memory of 1152	4412	40003d01db9c34da73a415792dba3a617fab65e91d2aae7bbbcd335af198a66b.exe	100
PID 1152 wrote to memory of 3660	1152	cmd.exe	102
PID 1152 wrote to memory of 3660	1152	cmd.exe	102
PID 1152 wrote to memory of 3660	1152	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\40003d01db9c34da73a415792dba3a617fab65e91d2aae7bbbcd335af198a66b.exe
"C:\Users\Admin\AppData\Local\Temp\40003d01db9c34da73a415792dba3a617fab65e91d2aae7bbbcd335af198a66b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c tzutil /g
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1152
- - C:\Windows\SysWOW64\tzutil.exe
    tzutil /g
    3⤵
    PID:3660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3920,i,1067197275908310731,12785105794523264014,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:8
1⤵
PID:1196

memory/4412-0-0x00000000001C0000-0x0000000000C34000-memory.dmp

Filesize
10.5MB

Download
memory/4412-4-0x0000000002C40000-0x0000000002C4E000-memory.dmp

Filesize
56KB

Download
memory/4412-8-0x0000000002C40000-0x0000000002C4E000-memory.dmp

Filesize
56KB

Download
memory/4412-7-0x0000000001130000-0x0000000001230000-memory.dmp

Filesize
1024KB

Download
memory/4412-9-0x0000000001130000-0x0000000001230000-memory.dmp

Filesize
1024KB

Download