db169f25692707b49683169c8757c0f719ee79e45a844390dc1fba5c98c4c3d4

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2023 15:51

Target

db169f25692707b49683169c8757c0f719ee79e45a844390dc1fba5c98c4c3d4.exe
Size

1.3MB
MD5

11d52d1941b4a6a87e32595b882ef134
SHA1

75e3eda0b263ff796dbb797ddfd5254c43c17b4d
SHA256

db169f25692707b49683169c8757c0f719ee79e45a844390dc1fba5c98c4c3d4
SHA512

d0d08fe5d768767033a5eef7ba4332b10d814521619e9e906e6620c79d3626112cdbdde2606079afc3aa9fcf3f52a241e4eb467272c64ef2d1c55e7e65a87a01
SSDEEP

24576:oBoaItPtKvxzx3+Yfg/FstTS6bX10keF:oCDrliVS6bXxeF

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1772	db169f25692707b49683169c8757c0f719ee79e45a844390dc1fba5c98c4c3d4.exe
1772	db169f25692707b49683169c8757c0f719ee79e45a844390dc1fba5c98c4c3d4.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 704	1772	db169f25692707b49683169c8757c0f719ee79e45a844390dc1fba5c98c4c3d4.exe	86
PID 1772 wrote to memory of 704	1772	db169f25692707b49683169c8757c0f719ee79e45a844390dc1fba5c98c4c3d4.exe	86

C:\Users\Admin\AppData\Local\Temp\db169f25692707b49683169c8757c0f719ee79e45a844390dc1fba5c98c4c3d4.exe
"C:\Users\Admin\AppData\Local\Temp\db169f25692707b49683169c8757c0f719ee79e45a844390dc1fba5c98c4c3d4.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:704