f3aad03db91c5cfba8dbf85c481a1f53f4f070aea0035a930a4bbbdf993a0b84

Analysis

max time kernel
151s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2023, 01:52

Target

501f551170db074944d28d53c2a79848.exe
Size

6.9MB
MD5

501f551170db074944d28d53c2a79848
SHA1

87f3725e9f13ffc12d6580dab5c6cd85ef4531fe
SHA256

f3aad03db91c5cfba8dbf85c481a1f53f4f070aea0035a930a4bbbdf993a0b84
SHA512

e4d58fca93e524f2626b3649d881f125cffee1e92f11b40ac8cff00eebb0fff92ec709b88831c0fa46f53499fd93c1e9058a1ff7a72de0508b91708dbd6fff96
SSDEEP

196608:gLCy35KlMtcsS4gxFRiL/UBEszyyBCB0fCB:goQcFRi4+YBPa

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 408 wrote to memory of 3320	408	501f551170db074944d28d53c2a79848.exe	87
PID 408 wrote to memory of 3320	408	501f551170db074944d28d53c2a79848.exe	87
PID 3320 wrote to memory of 2428	3320	cmd.exe	88
PID 3320 wrote to memory of 2428	3320	cmd.exe	88
PID 3320 wrote to memory of 1792	3320	cmd.exe	89
PID 3320 wrote to memory of 1792	3320	cmd.exe	89
PID 3320 wrote to memory of 4900	3320	cmd.exe	90
PID 3320 wrote to memory of 4900	3320	cmd.exe	90
PID 408 wrote to memory of 2792	408	501f551170db074944d28d53c2a79848.exe	93
PID 408 wrote to memory of 2792	408	501f551170db074944d28d53c2a79848.exe	93

C:\Users\Admin\AppData\Local\Temp\501f551170db074944d28d53c2a79848.exe
"C:\Users\Admin\AppData\Local\Temp\501f551170db074944d28d53c2a79848.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\501f551170db074944d28d53c2a79848.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3320
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\501f551170db074944d28d53c2a79848.exe" MD5
    3⤵
    PID:2428
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:1792
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:4900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color 9
  2⤵
  PID:2792

memory/408-2-0x00007FF73EF40000-0x00007FF73FDD4000-memory.dmp

Filesize
14.6MB

Download
memory/408-0-0x00007FFA02BB0000-0x00007FFA02BB2000-memory.dmp

Filesize
8KB

Download
memory/408-6-0x00007FF73EF40000-0x00007FF73FDD4000-memory.dmp

Filesize
14.6MB

Download