e2b3c3478fc9d5e4e126e320c4a95a307ef506d43f91bc409609d11ead67048a

Resubmissions

09/01/2023, 22:43

09/01/2023, 22:41

max time kernel
59s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2023, 22:41

Target
pdisretarded2.exe
Size 2.3MB
Sample230109-2mk14abe6x
SHA256 e2b3c3478fc9d5e4e126e320c4a95a307ef506d43f91bc409609d11ead67048a
MD5 1e6214772cbd64d9bbf226716228560b
SHA1 4bc557d253e363151f6509b600f7d7c4eddfd23d
SHA512 55bc9841d61fde4cd102ccef5c114b407f59b55956557681f9c2e72160a498964f8f65021819b41c30c9d9a92336453b30aa569d25369036613e99743b1dfeb4
SSDEEP 49152:jweBa7AyvysXznaWWG/f7X1iVfSPMhR+3MTuKaUarxNb1:jweBGAWysXGtG3Yt9hR+3O
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 2276	868	pdisretarded2.exe	82
PID 868 wrote to memory of 2276	868	pdisretarded2.exe	82
PID 868 wrote to memory of 2276	868	pdisretarded2.exe	82
PID 868 wrote to memory of 4612	868	pdisretarded2.exe	83
PID 868 wrote to memory of 4612	868	pdisretarded2.exe	83
PID 868 wrote to memory of 4612	868	pdisretarded2.exe	83
PID 868 wrote to memory of 3396	868	pdisretarded2.exe	84
PID 868 wrote to memory of 3396	868	pdisretarded2.exe	84
PID 868 wrote to memory of 3396	868	pdisretarded2.exe	84

C:\Users\Admin\AppData\Local\Temp\pdisretarded2.exe
"C:\Users\Admin\AppData\Local\Temp\pdisretarded2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2276
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c color d
  2⤵
  PID:4612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3396

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4232