c5ad4c089b1b75beb3e64c0a17237580d576950fb65e17aa6f3ec15765b0f642

Analysis

max time kernel
133s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 04:08

Target

c5ad4c089b1b75beb3e64c0a17237580d576950fb65e17aa6f3ec15765b0f642.exe
Size

48KB
MD5

005c40b882d18bccccba31fe8e31588b
SHA1

923e9226aee7b2c81220bc7faafe70251821acac
SHA256

c5ad4c089b1b75beb3e64c0a17237580d576950fb65e17aa6f3ec15765b0f642
SHA512

c5689916a6f27d49f68b7c7f58d3287675672997ed8861d99804e321420f2f213d3bd9398ac165f6f63efab7806db6c5c729dbe6e670b18a60eb76a26678ab37
SSDEEP

768:pYawuSDlQMpQ5TJOw0nG1e3LCh08QsXcuZdsUSWCG5/49Q9Xna:p3wuSy0p7l8QsJSWCGR4Ca

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2180	c5ad4c089b1b75beb3e64c0a17237580d576950fb65e17aa6f3ec15765b0f642.exe
2180	c5ad4c089b1b75beb3e64c0a17237580d576950fb65e17aa6f3ec15765b0f642.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 1672	2180	c5ad4c089b1b75beb3e64c0a17237580d576950fb65e17aa6f3ec15765b0f642.exe	80
PID 2180 wrote to memory of 1672	2180	c5ad4c089b1b75beb3e64c0a17237580d576950fb65e17aa6f3ec15765b0f642.exe	80
PID 2180 wrote to memory of 1672	2180	c5ad4c089b1b75beb3e64c0a17237580d576950fb65e17aa6f3ec15765b0f642.exe	80

C:\Users\Admin\AppData\Local\Temp\c5ad4c089b1b75beb3e64c0a17237580d576950fb65e17aa6f3ec15765b0f642.exe
"C:\Users\Admin\AppData\Local\Temp\c5ad4c089b1b75beb3e64c0a17237580d576950fb65e17aa6f3ec15765b0f642.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\\uninste56df49.bat" "C:\Users\Admin\AppData\Local\Temp\c5ad4c089b1b75beb3e64c0a17237580d576950fb65e17aa6f3ec15765b0f642.exe""
  2⤵
  PID:1672

C:\Users\Admin\AppData\Local\Temp\uninste56df49.bat

Filesize
59B

MD5
2988b921fbed03f9c93c5d538932bbe3

SHA1
4b791b3d59ae76ff091c2cf201b40f5d1b432a3f

SHA256
a1769979622d3d25829be12474ad32ccfdfcac59785dac2fc10ae49c300e4ea3

SHA512
2920c6e9851973371dc238da1ee3c63d41c7820637856ee92c67e9489c1790e3fad287d229440d124e60b978f6819d04b47c40de9034cbd9de422aaafc2b07f9

Download Submit
memory/2180-133-0x0000000000590000-0x000000000059F000-memory.dmp

Filesize
60KB

Download
memory/2180-132-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2180-135-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download