97b745d10fb3f47c24ed8d94a4d7104f6180ac5e390f1baf51494c787f44a382

Analysis

max time kernel
90s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2023 09:00

Target

97b745d10fb3f47c24ed8d94a4d7104f6180ac5e390f1baf51494c787f44a382.exe
Size

2.7MB
MD5

fd8f17d0aba63e68137ca0faf3b0c9fa
SHA1

a23c3b6812a3021807e2752a998ae5a296db590d
SHA256

97b745d10fb3f47c24ed8d94a4d7104f6180ac5e390f1baf51494c787f44a382
SHA512

a6e4b31331daf80b66a549d21fe445e06a2caf6e50434e87cba19e900d332c838d32bc836be5c00bc705c1be668acf29e4fcbf692a1a89a5b44313fd3577d421
SSDEEP

49152:EZtkfcpjcikE1XT7VZnHwaCGZPLN8yDpz+0Vv4CvJms+Lp1:EEfavVxwaCGtLN8yD40VvhJ4p

Score

1^/10

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 3488	4336	97b745d10fb3f47c24ed8d94a4d7104f6180ac5e390f1baf51494c787f44a382.exe	81
PID 4336 wrote to memory of 3488	4336	97b745d10fb3f47c24ed8d94a4d7104f6180ac5e390f1baf51494c787f44a382.exe	81
PID 4336 wrote to memory of 3488	4336	97b745d10fb3f47c24ed8d94a4d7104f6180ac5e390f1baf51494c787f44a382.exe	81
PID 3488 wrote to memory of 2256	3488	cmd.exe	82
PID 3488 wrote to memory of 2256	3488	cmd.exe	82
PID 3488 wrote to memory of 2256	3488	cmd.exe	82
PID 4336 wrote to memory of 4412	4336	97b745d10fb3f47c24ed8d94a4d7104f6180ac5e390f1baf51494c787f44a382.exe	83
PID 4336 wrote to memory of 4412	4336	97b745d10fb3f47c24ed8d94a4d7104f6180ac5e390f1baf51494c787f44a382.exe	83
PID 4336 wrote to memory of 4412	4336	97b745d10fb3f47c24ed8d94a4d7104f6180ac5e390f1baf51494c787f44a382.exe	83

C:\Users\Admin\AppData\Local\Temp\97b745d10fb3f47c24ed8d94a4d7104f6180ac5e390f1baf51494c787f44a382.exe
"C:\Users\Admin\AppData\Local\Temp\97b745d10fb3f47c24ed8d94a4d7104f6180ac5e390f1baf51494c787f44a382.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE CON COLS=215 LINES=22
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3488
- - C:\Windows\SysWOW64\mode.com
    MODE CON COLS=215 LINES=22
    3⤵
    PID:2256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color A
  2⤵
  PID:4412