f47e3555461472f23ab4766e4d5b6f6fd260e335a6abc31b860e569a720a5446

Resubmissions

28-12-2022 19:54

28-12-2022 19:50

max time kernel
73s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28-12-2022 19:50

Target

NS v.2.exe
Size

125KB
MD5

597de376b1f80c06d501415dd973dcec
SHA1

629c9649ced38fd815124221b80c9d9c59a85e74
SHA256

f47e3555461472f23ab4766e4d5b6f6fd260e335a6abc31b860e569a720a5446
SHA512

072565912208e97cc691e1a102e32fd6c243b5a3f8047a159e97aabbe302bddc36f3c52cecde3b506151bc89e0f3b5acf6552a82d83dac6e0180c873d36d3f6b
SSDEEP

1536:Vc4Kvp6PWy/6oU2cpzLWJst+cYsu0TXSkdlgNPldqxFktvVg49jvvck1y40sWjcu:Vc3GJQ56et+cT7SoeNdqbMfN7TId

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 540	4948	NS v.2.exe	83
PID 4948 wrote to memory of 540	4948	NS v.2.exe	83
PID 4948 wrote to memory of 540	4948	NS v.2.exe	83

C:\Users\Admin\AppData\Local\Temp\NS v.2.exe
"C:\Users\Admin\AppData\Local\Temp\NS v.2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:540