8b9242cdae9f1f916e026e7e09620a4f1cfd702caad9312dcd8c60c7921ed30d

Resubmissions

12/01/2023, 21:43

12/01/2023, 21:26

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2023, 21:26

Target

onlinedrive.exe
Size

377KB
MD5

cf16b73c4bc8b0b3169def3145515c51
SHA1

d96122f40c613ec7569b0afa431670827b2b20f2
SHA256

8b9242cdae9f1f916e026e7e09620a4f1cfd702caad9312dcd8c60c7921ed30d
SHA512

b09080e5afd57afcbd78dde9ef707f7afb74afd04515d800b5e2e0f7832755131a1c1b7a1f32383e569c9945ffd7b73f9b4c44d9c3894e78093a3cb751310c8f
SSDEEP

6144:RZzN/DXrMBfOxw4do6fmdrb3JjvYF0loyZ:RZ1r4szdogmBRvYF0loyZ

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 1440	2652	onlinedrive.exe	82
PID 2652 wrote to memory of 1440	2652	onlinedrive.exe	82
PID 2652 wrote to memory of 5056	2652	onlinedrive.exe	91
PID 2652 wrote to memory of 5056	2652	onlinedrive.exe	91
PID 2652 wrote to memory of 3824	2652	onlinedrive.exe	94
PID 2652 wrote to memory of 3824	2652	onlinedrive.exe	94
PID 2652 wrote to memory of 3464	2652	onlinedrive.exe	96
PID 2652 wrote to memory of 3464	2652	onlinedrive.exe	96
PID 2652 wrote to memory of 2316	2652	onlinedrive.exe	98
PID 2652 wrote to memory of 2316	2652	onlinedrive.exe	98
PID 2652 wrote to memory of 3496	2652	onlinedrive.exe	100
PID 2652 wrote to memory of 3496	2652	onlinedrive.exe	100
PID 2652 wrote to memory of 3864	2652	onlinedrive.exe	102
PID 2652 wrote to memory of 3864	2652	onlinedrive.exe	102

C:\Users\Admin\AppData\Local\Temp\onlinedrive.exe
"C:\Users\Admin\AppData\Local\Temp\onlinedrive.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\SYSTEM32\cmd.exe
  cmd
  2⤵
  PID:1440
- C:\Windows\SYSTEM32\cmd.exe
  cmd
  2⤵
  PID:5056
- C:\Windows\SYSTEM32\cmd.exe
  cmd
  2⤵
  PID:3824
- C:\Windows\SYSTEM32\cmd.exe
  cmd
  2⤵
  PID:3464
- C:\Windows\SYSTEM32\cmd.exe
  cmd
  2⤵
  PID:2316
- C:\Windows\SYSTEM32\cmd.exe
  cmd
  2⤵
  PID:3496
- C:\Windows\SYSTEM32\cmd.exe
  cmd
  2⤵
  PID:3864