d9d8306339ad71f6e941cdc5426ab5fefdfcfcb3cee8e54780e703d6c1e1ac77

Analysis

max time kernel
119s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20230220-es
resource tags

arch:x64arch:x86image:win10v2004-20230220-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
07/03/2023, 21:09

Target

WorkshopDL/Modules/gmad.exe
Size

337KB
MD5

c75dd9a6e7d10f8b73962f9d5d7a054f
SHA1

c554c5e3085c5830dbe21c78ef1424ef26169ec0
SHA256

861cd764ab2bf9d7c254e7237294c1a5884a23d5badbbf14ba67a2f9751b7b9b
SHA512

0e0975fed8c21f8cfc573bd3e083dad07d1e42aa1ec08899f39cb561a8cba34fc846f5b063b39b7dcf0d227daaa44b6a8844c45371b8419ecd3a5366d2c06878
SSDEEP

6144:HYs5YPVNWFXD7guG+WPp6m+j3eOtPgk3k6QdDAm8BAO5WlA2n:4s+PvW5guG+8p6m+j31PV3OMrBL2n

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 1884	4676	gmad.exe	84
PID 4676 wrote to memory of 1884	4676	gmad.exe	84
PID 4676 wrote to memory of 1884	4676	gmad.exe	84

C:\Users\Admin\AppData\Local\Temp\WorkshopDL\Modules\gmad.exe
"C:\Users\Admin\AppData\Local\Temp\WorkshopDL\Modules\gmad.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:1884