e7c0bdc7af86261b9a7cfc1c8e799d6d10bb65249428b5baace1cebc7ab72399

Analysis

max time kernel
167s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 23:05

Target

gR0Jd24.exe
Size

553KB
MD5

e194dea7cd10363a012aa8e1a44429c4
SHA1

87565e07b41e6198db4713e45b4830d1bf353963
SHA256

e7c0bdc7af86261b9a7cfc1c8e799d6d10bb65249428b5baace1cebc7ab72399
SHA512

7609f002c0b9c6b3bbecf4f246d7d98ae5ab39561e689453e064dba8b8d0548c7b9e2e5ec306d030fd03772e8c3d97aa3990090a6f7e327372af301bbb17cf8c
SSDEEP

12288:YlaTTFd2g+dmY6hBlE5euSULi0wI7jaErd:aYTFd2gmmja5euSU2rIiErd

Score

1^/10

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1604	2012	gR0Jd24.exe	87
PID 2012 wrote to memory of 1604	2012	gR0Jd24.exe	87
PID 2012 wrote to memory of 2280	2012	gR0Jd24.exe	88
PID 2012 wrote to memory of 2280	2012	gR0Jd24.exe	88
PID 2280 wrote to memory of 5080	2280	cmd.exe	89
PID 2280 wrote to memory of 5080	2280	cmd.exe	89
PID 2280 wrote to memory of 2212	2280	cmd.exe	90
PID 2280 wrote to memory of 2212	2280	cmd.exe	90
PID 2280 wrote to memory of 1980	2280	cmd.exe	91
PID 2280 wrote to memory of 1980	2280	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\gR0Jd24.exe
"C:\Users\Admin\AppData\Local\Temp\gR0Jd24.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c COLOR 0b
  2⤵
  PID:1604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\gR0Jd24.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2280
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\gR0Jd24.exe" MD5
    3⤵
    PID:5080
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:2212
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:1980