d9a3f2ad7cfc6989cc4da117d5a4f8097362aad6b91391e89746d68d8d7aa29f

Resubmissions

26/04/2023, 03:11

25/04/2023, 16:45

max time kernel
28s
max time network
76s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
25/04/2023, 16:45

Target

d9a3f2ad7cfc6989cc4da117d5a4f8097362aad6b91391e89746d68d8d7aa29f.exe
Size

175KB
MD5

13b929afb57a36f9c35e15aca70b75a7
SHA1

953c8210ec3f12f993f59755ee1f5bb51d41483e
SHA256

d9a3f2ad7cfc6989cc4da117d5a4f8097362aad6b91391e89746d68d8d7aa29f
SHA512

4bdfccb0aefc76b211e8c3dae05f94263c0aa7e5bf4d613a44f5d177a2708fdb06ad3dcc87071130d1e0a9bbc1578e76cf80da75fc505c36f9a83b2bb032fbb4
SSDEEP

3072:1xSDgRucbLV3P9iQ+kahx1HBKtxwe5Zhsp+duM0YC/:cgIcbR3PkBnHIxx5f0l

Score

6^/10

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	d9a3f2ad7cfc6989cc4da117d5a4f8097362aad6b91391e89746d68d8d7aa29f.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 1480	2024	d9a3f2ad7cfc6989cc4da117d5a4f8097362aad6b91391e89746d68d8d7aa29f.exe	29
PID 2024 wrote to memory of 1480	2024	d9a3f2ad7cfc6989cc4da117d5a4f8097362aad6b91391e89746d68d8d7aa29f.exe	29
PID 2024 wrote to memory of 1480	2024	d9a3f2ad7cfc6989cc4da117d5a4f8097362aad6b91391e89746d68d8d7aa29f.exe	29

C:\Users\Admin\AppData\Local\Temp\d9a3f2ad7cfc6989cc4da117d5a4f8097362aad6b91391e89746d68d8d7aa29f.exe
"C:\Users\Admin\AppData\Local\Temp\d9a3f2ad7cfc6989cc4da117d5a4f8097362aad6b91391e89746d68d8d7aa29f.exe"
1⤵
- Drops desktop.ini file(s)
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:1480