Analysis
-
max time kernel
139s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
27-01-2023 10:00
Static task
static1
Behavioral task
behavioral1
Sample
1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
-
Size
53KB
-
MD5
7791c18c9d4a94d80a7928644937c070
-
SHA1
41fca79af1747a862864d2c9114648d6f5404bed
-
SHA256
1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539
-
SHA512
81043a21b0e0588b3594210b2339c656d994b72b2787da68a5f433992e054c2bec961e4403997ec846f38862c15a1ff6c5f9faece1b122e838baec759e14f012
-
SSDEEP
768:XZvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5VmXOt:XZeytM3alnawrRIwxVSHMweio3xt
Score
10/10
Malware Config
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\DisableResume.crw => C:\Users\Admin\Pictures\DisableResume.crw.sickfile 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File renamed C:\Users\Admin\Pictures\ResizeUnlock.raw => C:\Users\Admin\Pictures\ResizeUnlock.raw.sickfile 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File renamed C:\Users\Admin\Pictures\ResolveSkip.crw => C:\Users\Admin\Pictures\ResolveSkip.crw.sickfile 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File renamed C:\Users\Admin\Pictures\ResumeConvertFrom.crw => C:\Users\Admin\Pictures\ResumeConvertFrom.crw.sickfile 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File renamed C:\Users\Admin\Pictures\ConvertToDisconnect.png => C:\Users\Admin\Pictures\ConvertToDisconnect.png.sickfile 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe" 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\offsym.ttf 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\sat_logo_2x.png 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageWideTile.scale-400_contrast-black.png 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.jrockit.mc.rcp.product_root_5.5.0.165303 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\vlc.mo 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-black\LargeTile.scale-200.png 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\offsymk.ttf 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreLogo.scale-200.png 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\5.jpg 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\resources.pri 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon_hover_2x.png 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-black\LargeTile.scale-100.png 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-nodes.xml 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\zh-tw\how_to_back_files.html 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNewNoteSmallTile.scale-150.png 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-20_altform-colorize.png 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\es-es\ui-strings.js 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl.winmd 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7d4.png 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-16_altform-unplated.png 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\deploy\messages_ja.properties 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\how_to_back_files.html 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\how_to_back_files.html 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\NavigationIcons\nav_icons_trending.targetsize-48.png 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-30_altform-unplated.png 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-64_contrast-black.png 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\PeopleMedTile.scale-125.png 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionMedTile.scale-400.png 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\da-dk\how_to_back_files.html 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\how_to_back_files.html 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\how_to_back_files.html 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-pl.xrm-ms 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeMediumTile.scale-200.png 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookLargeTile.scale-200.png 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-ma\how_to_back_files.html 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosLogoExtensions.targetsize-48.png 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\WideTile.scale-150.png 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-pl.xrm-ms 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-ppd.xrm-ms 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ppd.xrm-ms 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\home-view\selector.js 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\css\how_to_back_files.html 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailLargeTile.scale-200.png 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\TimerSmallTile.contrast-black_scale-100.png 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\LargeTile.scale-400_contrast-white.png 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-white\LargeTile.scale-100.png 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ppd.xrm-ms 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Cloud.png 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\Win10\MicrosoftSolitaireWideTile.scale-125.jpg 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_CatEye.png 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\190.png 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Programmer.targetsize-24_contrast-white.png 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleAppAssets\Videos\people_fre_motionAsset_p3.mp4 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ul-phn.xrm-ms 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-30_contrast-white.png 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\LockScreenBadgeLogo.scale-200.png 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ul-oob.xrm-ms 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\jvmti.h 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\zh-cn\how_to_back_files.html 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-96_altform-unplated.png 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 828 wrote to memory of 2684 828 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe 90 PID 828 wrote to memory of 2684 828 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe 90 PID 828 wrote to memory of 2684 828 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe"C:\Users\Admin\AppData\Local\Temp\1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe"1⤵
- Modifies extensions of user files
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe > nul2⤵PID:2684
-