b1ed0063b0dfbb769defcc2de51b59e1661791ec7eaa7232952bc63300085e9c

Analysis

max time kernel
550s
max time network
503s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2022, 13:45

Target

Nowy folder (2).zip
Size

159KB
MD5

e69a6b4780eb0bbf3da5068e042f8080
SHA1

05037d937ad7787642b4bbd25ac1e44a9edb7ece
SHA256

b1ed0063b0dfbb769defcc2de51b59e1661791ec7eaa7232952bc63300085e9c
SHA512

c7fd2dad13b365d00ebc896894eb478684602d3d01ca1ad9ca89194348838ae04af5b8b83fe41596b4dcb1400ffea781a1ee88e6de25cd56750c1bc44c7ef15f
SSDEEP

3072:GHzUHBmJFKj2yzOxTYnKHue72lt1Ec68uft8Ib5hKBF5wsHvzmZR8t:GQh8KPK+KHueqtN69V8WIpvz4R8t

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 3900	1092	cmd.exe	107
PID 1092 wrote to memory of 3900	1092	cmd.exe	107

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Nowy folder (2).zip"
1⤵
PID:1440

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3668

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" \armeta.dat,init
1⤵
PID:2024

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\system32\rundll32.exe
  rundll32.exe armeta.dat,init
  2⤵
  PID:3900