b6fa6c6eda847b0886239c298632deca91411bebd2a05dde31f0a373a8558154

Analysis

max time kernel
135s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
31-03-2023 12:54

Target

Desktop/50135b3cd8e475e98d6e1c9886bb8cd10f400096dfc840f174fc4545fb0a3b92.exe
Size

221KB
MD5

812e6a209b063b65661987c557cf9971
SHA1

3c0709db8983a91cb32b464fba7ce3af396758c3
SHA256

50135b3cd8e475e98d6e1c9886bb8cd10f400096dfc840f174fc4545fb0a3b92
SHA512

6173d24eb79796b7a78dc193c62964acc5e8533ce82379854b78f3cd3fdc3b5a3eb255b47493ced7c769c862196fe3e90463c51597f481c43798ee8d5aa96962
SSDEEP

3072:hvTiJQepu4he4l6Yjyb453JwmuRljmScpBl9PLa3d+EIeHEjktcv1oKGys85fCp:hiAWOy3JwHRlinBl9PLBgWCp

Score

1^/10

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2784 PING.EXE

pid	process
2784	PING.EXE

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

50135b3cd8e475e98d6e1c9886bb8cd10f400096dfc840f174fc4545fb0a3b92.execmd.exe

description	pid	process	target process
PID 2820 wrote to memory of 4964	2820	50135b3cd8e475e98d6e1c9886bb8cd10f400096dfc840f174fc4545fb0a3b92.exe	cmd.exe
PID 2820 wrote to memory of 4964	2820	50135b3cd8e475e98d6e1c9886bb8cd10f400096dfc840f174fc4545fb0a3b92.exe	cmd.exe
PID 2820 wrote to memory of 4964	2820	50135b3cd8e475e98d6e1c9886bb8cd10f400096dfc840f174fc4545fb0a3b92.exe	cmd.exe
PID 4964 wrote to memory of 2784	4964	cmd.exe	PING.EXE
PID 4964 wrote to memory of 2784	4964	cmd.exe	PING.EXE
PID 4964 wrote to memory of 2784	4964	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\Desktop\50135b3cd8e475e98d6e1c9886bb8cd10f400096dfc840f174fc4545fb0a3b92.exe
"C:\Users\Admin\AppData\Local\Temp\Desktop\50135b3cd8e475e98d6e1c9886bb8cd10f400096dfc840f174fc4545fb0a3b92.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2820

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ping www.baidu.com
2⤵
- Suspicious use of WriteProcessMemory
PID:4964

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact