eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a

Resubmissions

25/04/2023, 18:13

25/04/2023, 16:35

max time kernel
92s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
25/04/2023, 16:35

Target
eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a.exe
Size 174KB
Sample230425-t3wtjadd5x
SHA256 eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a
MD5 3d1c060f9a0bd16fe0275f92a3c151a8
SHA1 b7418df98b087f975c30a3e58315955beb792694
SHA512 2c04a81b5fbc4a3841feb39df866aef1fe44e11841ee84d3883b30c0f40395b6551d22ec5ca529f94659bee43efdc0e45f6f4a81881dc101619dbc9d29434c63
SSDEEP 3072:xgwEVWPt0ViQnTohFBhJ+kNn0B47y8Jsp+d2aNEC6:QVUt0VigypLN4kyR8R
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 2076	784	eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a.exe	84
PID 784 wrote to memory of 2076	784	eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a.exe	84

C:\Users\Admin\AppData\Local\Temp\eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a.exe
"C:\Users\Admin\AppData\Local\Temp\eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a.exe"
1⤵
- Drops desktop.ini file(s)
- Suspicious use of WriteProcessMemory
PID:784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:2076