7867e5f14c55bdfa3f8ffd2ee1e876a9dfa2d971f3e368a9025060e31a7a7def

Analysis

max time kernel
30s
max time network
32s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2023, 08:57

Target

obscure.win.exe
Size

1.6MB
MD5

5b9c1551bfe5291e18fc33016b399c40
SHA1

5b6df064b62c52db482f23e0cb0f642261199a3e
SHA256

7867e5f14c55bdfa3f8ffd2ee1e876a9dfa2d971f3e368a9025060e31a7a7def
SHA512

5a6a6ec13e3fa36624a021014b8dea5cc79fbd5fa0699df0b2d0b8b06d586f9e5acde93c8d5c68a9fc0da0cbf2cff2f303c9f1fccd6b71cfb295c934239159ce
SSDEEP

24576:vG1/39vn0sHTqn51wjrdM/EsGiwxqmNafWWuXUanLG8VTmGwc06jxR:+1/6sWn51wKrLEXoWXXFnlMGAU

Score

1^/10

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 2656	636	obscure.win.exe	84
PID 636 wrote to memory of 2656	636	obscure.win.exe	84
PID 2656 wrote to memory of 876	2656	cmd.exe	85
PID 2656 wrote to memory of 876	2656	cmd.exe	85
PID 2656 wrote to memory of 1972	2656	cmd.exe	86
PID 2656 wrote to memory of 1972	2656	cmd.exe	86
PID 2656 wrote to memory of 388	2656	cmd.exe	87
PID 2656 wrote to memory of 388	2656	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\obscure.win.exe
"C:\Users\Admin\AppData\Local\Temp\obscure.win.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\obscure.win.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\obscure.win.exe" MD5
    3⤵
    PID:876
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:1972
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:388