4d1fd74193432c65a5a4262e8a4e89c7fdfbdd21970159a56abf8bbfa5dab68c

Analysis

max time kernel
134s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2022, 23:55

Target

4d1fd74193432c65a5a4262e8a4e89c7fdfbdd21970159a56abf8bbfa5dab68c.exe
Size

67KB
MD5

c291d8d8da9d44437bd8e5616a00a62b
SHA1

ba8d804f925259a2dc29811333fc61ea7c57f25b
SHA256

4d1fd74193432c65a5a4262e8a4e89c7fdfbdd21970159a56abf8bbfa5dab68c
SHA512

43fb911b07bef0539703f4f588df2c26bda7c8bac36a8a5e6e36e174204208feef9944762ecd46f1814ab6cdc816603f50876513c1b88eb9b9bcfd05af90fea3
SSDEEP

768:+Nt3A3M/z/z5yvGyfUG5f02p/7DNtoL5ehRNS1oFKBM4kRu+AeDIdFZj9TjFCQQC:g3AczqZPNtodXmBQjTJCNigP0jot4EBk

Score

1^/10

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
644	PING.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4696	4d1fd74193432c65a5a4262e8a4e89c7fdfbdd21970159a56abf8bbfa5dab68c.exe
4696	4d1fd74193432c65a5a4262e8a4e89c7fdfbdd21970159a56abf8bbfa5dab68c.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 1976	4696	4d1fd74193432c65a5a4262e8a4e89c7fdfbdd21970159a56abf8bbfa5dab68c.exe	84
PID 4696 wrote to memory of 1976	4696	4d1fd74193432c65a5a4262e8a4e89c7fdfbdd21970159a56abf8bbfa5dab68c.exe	84
PID 4696 wrote to memory of 1976	4696	4d1fd74193432c65a5a4262e8a4e89c7fdfbdd21970159a56abf8bbfa5dab68c.exe	84
PID 1976 wrote to memory of 644	1976	cmd.exe	86
PID 1976 wrote to memory of 644	1976	cmd.exe	86
PID 1976 wrote to memory of 644	1976	cmd.exe	86

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact