f47e3555461472f23ab4766e4d5b6f6fd260e335a6abc31b860e569a720a5446

Resubmissions

29/11/2022, 11:04

29/11/2022, 10:57

max time kernel
90s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 10:57

Target

NetworkShare_pre2.exe
Size

125KB
MD5

597de376b1f80c06d501415dd973dcec
SHA1

629c9649ced38fd815124221b80c9d9c59a85e74
SHA256

f47e3555461472f23ab4766e4d5b6f6fd260e335a6abc31b860e569a720a5446
SHA512

072565912208e97cc691e1a102e32fd6c243b5a3f8047a159e97aabbe302bddc36f3c52cecde3b506151bc89e0f3b5acf6552a82d83dac6e0180c873d36d3f6b
SSDEEP

1536:Vc4Kvp6PWy/6oU2cpzLWJst+cYsu0TXSkdlgNPldqxFktvVg49jvvck1y40sWjcu:Vc3GJQ56et+cT7SoeNdqbMfN7TId

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 4344	1688	NetworkShare_pre2.exe	82
PID 1688 wrote to memory of 4344	1688	NetworkShare_pre2.exe	82
PID 1688 wrote to memory of 4344	1688	NetworkShare_pre2.exe	82

C:\Users\Admin\AppData\Local\Temp\NetworkShare_pre2.exe
"C:\Users\Admin\AppData\Local\Temp\NetworkShare_pre2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4344