bd024a2d3614619580133f7b37229fc02ddc33cbec6dedd2d2354ee2aee4625e

Resubmissions

08/09/2022, 11:31

max time kernel
39s
max time network
42s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2022, 11:31

Target

injector.exe
Size

16KB
MD5

c1abd742955d66bc6432dbfe00ba0f7d
SHA1

7dcb4f0fb56488db3f62cc80935ff1adae579b18
SHA256

bd024a2d3614619580133f7b37229fc02ddc33cbec6dedd2d2354ee2aee4625e
SHA512

a06830d5a2293a698e37a338804812e9f7863f577475b626c7b487c530315f4488d8ea35e3252be24c92ab9a00fe4d43484e78447bd16eed5fe5f9c661afd53c
SSDEEP

384:n4JL552CiFFm9HputtO1fChA0EX8jcmeH0/q+bOGHdVFwC:n4Z2tcNfC+0EXMVlb/Hd

Score

1^/10

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 444	3368	injector.exe	82
PID 3368 wrote to memory of 444	3368	injector.exe	82
PID 3368 wrote to memory of 444	3368	injector.exe	82
PID 3368 wrote to memory of 2192	3368	injector.exe	83
PID 3368 wrote to memory of 2192	3368	injector.exe	83
PID 3368 wrote to memory of 2192	3368	injector.exe	83
PID 3368 wrote to memory of 3188	3368	injector.exe	92
PID 3368 wrote to memory of 3188	3368	injector.exe	92
PID 3368 wrote to memory of 3188	3368	injector.exe	92
PID 3368 wrote to memory of 1948	3368	injector.exe	94
PID 3368 wrote to memory of 1948	3368	injector.exe	94
PID 3368 wrote to memory of 1948	3368	injector.exe	94
PID 3368 wrote to memory of 1480	3368	injector.exe	95
PID 3368 wrote to memory of 1480	3368	injector.exe	95
PID 3368 wrote to memory of 1480	3368	injector.exe	95

C:\Users\Admin\AppData\Local\Temp\injector.exe
"C:\Users\Admin\AppData\Local\Temp\injector.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c color D
  2⤵
  PID:2192
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3188
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c color D
  2⤵
  PID:1480