e2b3c3478fc9d5e4e126e320c4a95a307ef506d43f91bc409609d11ead67048a

Resubmissions

09/01/2023, 22:43

09/01/2023, 22:41

max time kernel
37s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
09/01/2023, 22:41

Target
pdisretarded2.exe
Size 2.3MB
Sample230109-2mk14abe6x
SHA256 e2b3c3478fc9d5e4e126e320c4a95a307ef506d43f91bc409609d11ead67048a
MD5 1e6214772cbd64d9bbf226716228560b
SHA1 4bc557d253e363151f6509b600f7d7c4eddfd23d
SHA512 55bc9841d61fde4cd102ccef5c114b407f59b55956557681f9c2e72160a498964f8f65021819b41c30c9d9a92336453b30aa569d25369036613e99743b1dfeb4
SSDEEP 49152:jweBa7AyvysXznaWWG/f7X1iVfSPMhR+3MTuKaUarxNb1:jweBGAWysXGtG3Yt9hR+3O
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1644	2036	pdisretarded2.exe	28
PID 2036 wrote to memory of 1644	2036	pdisretarded2.exe	28
PID 2036 wrote to memory of 1644	2036	pdisretarded2.exe	28
PID 2036 wrote to memory of 1644	2036	pdisretarded2.exe	28
PID 2036 wrote to memory of 1812	2036	pdisretarded2.exe	29
PID 2036 wrote to memory of 1812	2036	pdisretarded2.exe	29
PID 2036 wrote to memory of 1812	2036	pdisretarded2.exe	29
PID 2036 wrote to memory of 1812	2036	pdisretarded2.exe	29

C:\Users\Admin\AppData\Local\Temp\pdisretarded2.exe
"C:\Users\Admin\AppData\Local\Temp\pdisretarded2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1644
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c color d
  2⤵
  PID:1812

memory/2036-54-0x0000000075C61000-0x0000000075C63000-memory.dmp

Download