746f16894bed0dfbb80b7ab26aef60894bbe0e0a8645fc390c9222bc00517c26

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2023, 10:13

Target

Hospital Mangement.exe
Size

1.9MB
MD5

e45b1600671b8bfdfdaccbc8c18904d7
SHA1

574a0563a0d8f3394212878d61c056bbd42eabe6
SHA256

746f16894bed0dfbb80b7ab26aef60894bbe0e0a8645fc390c9222bc00517c26
SHA512

4564934f97bf80b10e3ed91528790369fafab00b33fd18b388e00a1a38c5909fc2e3b056220e1d760b50f7216db0c628a7709e8ad5499d4c3ace7cfdef9f9ae0
SSDEEP

24576:JcvhUUT1+oKLfMmjVy5QgsJ7DWjzvGZo+Ec0xMko8JsU3AoUqqIpys/5F:GvhUUTJKLfW5WDe6XqqIpys/5F

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 1184	5040	Hospital Mangement.exe	85
PID 5040 wrote to memory of 1184	5040	Hospital Mangement.exe	85
PID 5040 wrote to memory of 1164	5040	Hospital Mangement.exe	86
PID 5040 wrote to memory of 1164	5040	Hospital Mangement.exe	86

C:\Users\Admin\AppData\Local\Temp\Hospital Mangement.exe
"C:\Users\Admin\AppData\Local\Temp\Hospital Mangement.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color 5a
  2⤵
  PID:1164

memory/5040-133-0x0000000000400000-0x0000000000504000-memory.dmp

Filesize
1.0MB

Download