039004b76a1bc5ac020958256bdcf97f1464398c13b0be2e0d0078f1aee8b3a7

Analysis

max time kernel
141s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 21:48

Target

039004b76a1bc5ac020958256bdcf97f1464398c13b0be2e0d0078f1aee8b3a7.exe
Size

538KB
MD5

64da00119c76c6e1d75f059ffc4a772d
SHA1

ebaebff7db60430cad107d4efc45654d43f98075
SHA256

039004b76a1bc5ac020958256bdcf97f1464398c13b0be2e0d0078f1aee8b3a7
SHA512

d13544aa2ee6060510c0f906e3f174a4ec40878f36193a99d6c527b62fa6a379115e965e272069b0e3f0479df16e6899a096ede37fb0832262c72d3d24f824f3
SSDEEP

12288:AS3yBV888888888888W88888888888pKfXGU69eTutORzK/AA9i6Zub02O9HtFbl:/3yLKfXG6wZ/D9kqtZaTq

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4620	039004b76a1bc5ac020958256bdcf97f1464398c13b0be2e0d0078f1aee8b3a7.tmp

Loads dropped DLL 1 IoCs

pid	Process
4620	039004b76a1bc5ac020958256bdcf97f1464398c13b0be2e0d0078f1aee8b3a7.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 4620	2416	039004b76a1bc5ac020958256bdcf97f1464398c13b0be2e0d0078f1aee8b3a7.exe	83
PID 2416 wrote to memory of 4620	2416	039004b76a1bc5ac020958256bdcf97f1464398c13b0be2e0d0078f1aee8b3a7.exe	83
PID 2416 wrote to memory of 4620	2416	039004b76a1bc5ac020958256bdcf97f1464398c13b0be2e0d0078f1aee8b3a7.exe	83

C:\Users\Admin\AppData\Local\Temp\039004b76a1bc5ac020958256bdcf97f1464398c13b0be2e0d0078f1aee8b3a7.exe
"C:\Users\Admin\AppData\Local\Temp\039004b76a1bc5ac020958256bdcf97f1464398c13b0be2e0d0078f1aee8b3a7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Users\Admin\AppData\Local\Temp\is-0HIVF.tmp\039004b76a1bc5ac020958256bdcf97f1464398c13b0be2e0d0078f1aee8b3a7.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-0HIVF.tmp\039004b76a1bc5ac020958256bdcf97f1464398c13b0be2e0d0078f1aee8b3a7.tmp" /SL5="$70048,164153,114176,C:\Users\Admin\AppData\Local\Temp\039004b76a1bc5ac020958256bdcf97f1464398c13b0be2e0d0078f1aee8b3a7.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4620

C:\Users\Admin\AppData\Local\Temp\is-0HIVF.tmp\039004b76a1bc5ac020958256bdcf97f1464398c13b0be2e0d0078f1aee8b3a7.tmp

Filesize
1.1MB

MD5
f120c361b527a9d090782300aa8f1ce5

SHA1
ed82441da0dc7a5695ef96839fc2aea0f0c7e376

SHA256
9209a83ac4b0127081327b6e03960e2a4325dbb31f0bba2b56dfb785583f9825

SHA512
60fc418c4296f67b923e1fff4e6034ed41eeba61604b14d560cfd84e7476b59311c6029aee7ee602d8fdc635107855e5c05dcf6a0137c6ba89db7134e63e5555

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-FTUC0.tmp\isxdl.dll

Filesize
131KB

MD5
16881920cbe9ddb46c3ef29ee405a857

SHA1
0f76cffc2e57cf5c481a8015d203b96638d36ef5

SHA256
59abe5f46020cb56e1079df8dc1145b2033e4b1459ae3d92f637064a6b618bc1

SHA512
f07d1f4133a2ba2bda92fa6f55360fae73e44b97756ee3044f31af5f9e01cda34e7efbb1520c0b5aa2a496edc03ed4fefdc4ad419c1028b1ce6457b69aabeba0

Download Submit
memory/2416-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2416-2-0x0000000000401000-0x0000000000410000-memory.dmp

Filesize
60KB

Download
memory/2416-25-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4620-7-0x0000000000400000-0x0000000000529000-memory.dmp

Filesize
1.2MB

Download
memory/4620-17-0x0000000000400000-0x0000000000529000-memory.dmp

Filesize
1.2MB

Download
memory/4620-26-0x0000000000400000-0x0000000000529000-memory.dmp

Filesize
1.2MB

Download
memory/4620-29-0x0000000000400000-0x0000000000529000-memory.dmp

Filesize
1.2MB

Download