8df5792b05ba94e1d54879f8a48978eb9135eb073cb65af020581608e349fe59

Analysis

max time kernel
105s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2023, 23:03

Target

outshell_client.exe
Size

5KB
MD5

cb2aee2281ede8cabea0d4662da6f770
SHA1

5d3cc3bbfd7fb44bd90ede9f3d7ca8b424be944a
SHA256

8df5792b05ba94e1d54879f8a48978eb9135eb073cb65af020581608e349fe59
SHA512

e3881131e343e712a3b26d61575d855e26b86e9e4b3e78feb74855dc7bd470c9e22d835585b06a3640c9df12d6e67d2fe4c94b77861c0c78c2d35b5570acc598
SSDEEP

48:6vqlSkg7WrPkX9/H7QUQvY19EYZ0hSCLSNMCEG5DAMMElqGGjbLbW0itpslxAYAh:ljrg/H7QUBEZhS7R5SjGGjfCC0WBzNt

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 4432	4252	outshell_client.exe	95
PID 4252 wrote to memory of 4432	4252	outshell_client.exe	95
PID 4252 wrote to memory of 4432	4252	outshell_client.exe	95
PID 4432 wrote to memory of 4400	4432	cmd.exe	97
PID 4432 wrote to memory of 4400	4432	cmd.exe	97
PID 4432 wrote to memory of 4400	4432	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\outshell_client.exe
"C:\Users\Admin\AppData\Local\Temp\outshell_client.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C start
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe
    3⤵
    PID:4400

memory/4252-133-0x0000000000510000-0x0000000000518000-memory.dmp

Filesize
32KB

Download
memory/4252-134-0x0000000004EF0000-0x0000000004F00000-memory.dmp

Filesize
64KB

Download
memory/4252-135-0x0000000004EF0000-0x0000000004F00000-memory.dmp

Filesize
64KB

Download