eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a

Resubmissions

25/04/2023, 18:13

25/04/2023, 16:35

max time kernel
135s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
25/04/2023, 18:13

Target

eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a.exe
Size

174KB
MD5

3d1c060f9a0bd16fe0275f92a3c151a8
SHA1

b7418df98b087f975c30a3e58315955beb792694
SHA256

eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a
SHA512

2c04a81b5fbc4a3841feb39df866aef1fe44e11841ee84d3883b30c0f40395b6551d22ec5ca529f94659bee43efdc0e45f6f4a81881dc101619dbc9d29434c63
SSDEEP

3072:xgwEVWPt0ViQnTohFBhJ+kNn0B47y8Jsp+d2aNEC6:QVUt0VigypLN4kyR8R

Score

6^/10

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3732 wrote to memory of 3232	3732	eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a.exe	82
PID 3732 wrote to memory of 3232	3732	eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a.exe	82

C:\Users\Admin\AppData\Local\Temp\eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a.exe
"C:\Users\Admin\AppData\Local\Temp\eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a.exe"
1⤵
- Drops desktop.ini file(s)
- Suspicious use of WriteProcessMemory
PID:3732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:3232