91f8df9d46f5ca9ba120d851ce77270652ff1556bf0734016e7befde63d7e667

Resubmissions

16/12/2022, 21:44

16/12/2022, 21:23

15/12/2022, 16:55

max time kernel
501s
max time network
510s
platform
windows10-2004_x64
resource
win10v2004-20220812-es
resource tags

arch:x64arch:x86image:win10v2004-20220812-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
16/12/2022, 21:23

Target

ID_Arch-ISVZCfxciuausvaFTZDKfmfvfuzifb.exe
Size

340.2MB
MD5

ba05be572473f867c79b80342bf91c19
SHA1

131474077821afdd7602bb9ee2f439f5dabdb0d3
SHA256

b2cf10eea2310873d4061df387fa6ef44d3e2f053ac5a03a409cc1bd1cd9c4e5
SHA512

d5ffe37008a3255b35cac2d4ff4028e5324e3b9fc0380dcd2bb22f49b147452d70eacd78f135b2eaac17ae5f2042029806510fc094aa203b2b053b0f4bbfbfd2
SSDEEP

98304:qoXv7bC5weNEUNQdatPKUaKupJhARCZrCxrAhJ1LpqfE:qmO5weNEUic+iuOxrAhJ1LW

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2956	2184	ID_Arch-ISVZCfxciuausvaFTZDKfmfvfuzifb.exe	80
PID 2184 wrote to memory of 2956	2184	ID_Arch-ISVZCfxciuausvaFTZDKfmfvfuzifb.exe	80

C:\Users\Admin\AppData\Local\Temp\ID_Arch-ISVZCfxciuausvaFTZDKfmfvfuzifb.exe
"C:\Users\Admin\AppData\Local\Temp\ID_Arch-ISVZCfxciuausvaFTZDKfmfvfuzifb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4856