224c2cfcbeaa3500dcd6bc56863998954ad86e2a465ae03727925d65f172d36c

Analysis

max time kernel
165s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28/11/2022, 03:34

Target

224c2cfcbeaa3500dcd6bc56863998954ad86e2a465ae03727925d65f172d36c.exe
Size

1.7MB
MD5

2389f8e6150d582831bc4f689dfdffb0
SHA1

69bddd958d93fa2ff666b3ce3249339380ae3ce7
SHA256

224c2cfcbeaa3500dcd6bc56863998954ad86e2a465ae03727925d65f172d36c
SHA512

9f5db9b5a0bf2bb066ac018cfa3a6066f3dbebf28dde46c17456c4b1a70c4568753e65ee501c0c3542d8bb5cb8926d36354b10a7f42f0b9dbda6a69e3755da83
SSDEEP

24576:lVSL6ZcViR7SVLppwidNf0S3ei3832FAd60IB7wgU8PtCG8Slw4HvVWv:b92w0VLppwidOS3eJ2w6t1H9feU9W

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3776	224c2cfcbeaa3500dcd6bc56863998954ad86e2a465ae03727925d65f172d36c.exe
3776	224c2cfcbeaa3500dcd6bc56863998954ad86e2a465ae03727925d65f172d36c.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3776 wrote to memory of 3380	3776	224c2cfcbeaa3500dcd6bc56863998954ad86e2a465ae03727925d65f172d36c.exe	84
PID 3776 wrote to memory of 3380	3776	224c2cfcbeaa3500dcd6bc56863998954ad86e2a465ae03727925d65f172d36c.exe	84
PID 3776 wrote to memory of 3380	3776	224c2cfcbeaa3500dcd6bc56863998954ad86e2a465ae03727925d65f172d36c.exe	84

C:\Users\Admin\AppData\Local\Temp\224c2cfcbeaa3500dcd6bc56863998954ad86e2a465ae03727925d65f172d36c.exe
"C:\Users\Admin\AppData\Local\Temp\224c2cfcbeaa3500dcd6bc56863998954ad86e2a465ae03727925d65f172d36c.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3776
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\_tmpxqr.bat"
  2⤵
  PID:3380

C:\Users\Admin\AppData\Roaming\_tmpxqr.bat

Filesize
200B

MD5
d0971b21bcbfd34afdde1fd168f0204e

SHA1
64c738c3ceff7ba7ee2430d69ab75425e34dbbb8

SHA256
ae5bbbd9000403344fb0f8b49e405ce8351bdb67a9aefbb947930470a90eab37

SHA512
3b19d82e7c2931792e3657e38b09d8830fe9044a9c3a714dc7ebdd3c4de4458c63284563b3734ec741e88f84d85f162189f3bfa9e987c389aaad6a8aa47dc312

Download Submit
memory/3776-132-0x0000000002620000-0x00000000026A4000-memory.dmp

Filesize
528KB

Download
memory/3776-133-0x0000000000190000-0x0000000000349000-memory.dmp

Filesize
1.7MB

Download
memory/3776-135-0x0000000000190000-0x0000000000349000-memory.dmp

Filesize
1.7MB

Download