a56216c1e77c79d6622e0fdc00ba235507d6de14eeb7b121770f8b70d80e8b77

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
01/04/2023, 23:13

Target

Hardzy - Internal V.2/P100_Injector.exe
Size

14KB
MD5

1a84be14996659efce7019088296a22b
SHA1

8b0ddff2a635df6dfd914958c4119987a8445376
SHA256

4d70fde281f97dbdddf62150b0948ea92de5498628bc132b17663402410d20e6
SHA512

72df65e51d5ec85353c274026bac8b9ee4fa439e15ff59780af2bbe4211d3d7e09e0d28a6c1abd3cb1a7a1ea4d920bc88658c196bd1aac030e1f3d44a9b6066d
SSDEEP

192:l3oX/bCYieI6pxQexABxqj75DLlwGaBjeA0iaAws681iW5tfBD7w:l3oX/GYieIYQgALqZDBGCRs

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1724	1736	P100_Injector.exe	29
PID 1736 wrote to memory of 1724	1736	P100_Injector.exe	29
PID 1736 wrote to memory of 1724	1736	P100_Injector.exe	29

C:\Users\Admin\AppData\Local\Temp\Hardzy - Internal V.2\P100_Injector.exe
"C:\Users\Admin\AppData\Local\Temp\Hardzy - Internal V.2\P100_Injector.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:1724