13e1bf9ae1a6f6f62b7d67bc5111bb9e4e37c6030016f580a774ce7a50c714e0

Analysis

max time kernel
140s
max time network
273s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2023, 04:50

Target
starter.exe
Size 2.6MB
Sample230713-ff8b6afd32
SHA256 13e1bf9ae1a6f6f62b7d67bc5111bb9e4e37c6030016f580a774ce7a50c714e0
MD5 52d40dca2b6bc90659748dffaea01a4d
SHA1 263a3e5b6904675ef4004f8cc2b15a105547731f
SHA512 331fe7bb0a2a3d798ee31e4942e43161bd74547cfc329399e5bc3fb4023a98273d38afc7b23352bda8e69a5dbad5d0813934aa254afe14b6f32a2b9d5a75abc2
SSDEEP 49152:/yPIN3S3jgrb/T/vO90d7HjmAFd4A64nsfJG6CIgPKBvkkv6D1dZNkFrvc3AXTGy:iX3jV9eZNkFrv9CFLhMWZ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3896 wrote to memory of 456	3896	starter.exe	85
PID 3896 wrote to memory of 456	3896	starter.exe	85

C:\Users\Admin\AppData\Local\Temp\starter.exe
"C:\Users\Admin\AppData\Local\Temp\starter.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3896
- C:\Windows\system32\cmd.exe
  cmd.exe /C cd C:\Users\Admin\AppData\Local\Temp && C:\Users\Admin\AppData\Local\Temp\EmailPasswordRecoveryPro.exe mails.html
  2⤵
  PID:456