4151bfdd1db1f0f693ee701d8d0f329d49992b2169ac251089335296cb3b4c96

Analysis

max time kernel
135s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2023, 12:52

Target
4151bfdd1db1f0f693ee701d8d0f329d49992b2169ac251089335296cb3b4c96.exe
Size 4.5MB
Sample230510-p375caga85
SHA256 4151bfdd1db1f0f693ee701d8d0f329d49992b2169ac251089335296cb3b4c96
MD5 09217841988e0cdb9c6a62c2ce8042cb
SHA1 e6ff53302c09b0ffe4b9c3115d9fe924b485a13a
SHA512 e5cb5aa8d311ab15649c72c0ec648e6ba7579db5a6ab7364cf28d100508606654cab542ef23c803504e0322388e4ef2cff8c146aad2b30a2df667c122df8305e
SSDEEP 49152:HITFwuUfkWk5cS7a+9XYaQkZehc4mTYJ78V9gyBn4cBfmP/SA8N:oTwXajJ3Z942KQV9hp4QfmP/SA8
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 3684	4936	4151bfdd1db1f0f693ee701d8d0f329d49992b2169ac251089335296cb3b4c96.exe	83
PID 4936 wrote to memory of 3684	4936	4151bfdd1db1f0f693ee701d8d0f329d49992b2169ac251089335296cb3b4c96.exe	83
PID 4936 wrote to memory of 3684	4936	4151bfdd1db1f0f693ee701d8d0f329d49992b2169ac251089335296cb3b4c96.exe	83

C:\Users\Admin\AppData\Local\Temp\4151bfdd1db1f0f693ee701d8d0f329d49992b2169ac251089335296cb3b4c96.exe
"C:\Users\Admin\AppData\Local\Temp\4151bfdd1db1f0f693ee701d8d0f329d49992b2169ac251089335296cb3b4c96.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:3684

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact