f21701613a2bd0bba853afbe8e6ad0c0e096bb114791d4e7f568a9404d821960

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
28/11/2023, 01:30

Target

2601768e63b72839d4b5cd5e61b658ed.exe
Size

85KB
MD5

2601768e63b72839d4b5cd5e61b658ed
SHA1

eda4c123c80f2338a417b7a8b72970b2b7a78211
SHA256

f21701613a2bd0bba853afbe8e6ad0c0e096bb114791d4e7f568a9404d821960
SHA512

d671b8eea526baec3c3561f364263dcec471594dc491ca14fefb516e2fb64068b2d413920a30e81ca563867ebf3c5f7341c3e78410bdf34cd92256145bc8f771
SSDEEP

768:KPvwALzqd50uL5ec/zXSkpUctBwLMPae5m1TvHKPUggROwWXcY7FsE:Gvnzqd5FQ8XCYmTvHoBf9

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2992	2956	2601768e63b72839d4b5cd5e61b658ed.exe	29
PID 2956 wrote to memory of 2992	2956	2601768e63b72839d4b5cd5e61b658ed.exe	29
PID 2956 wrote to memory of 2992	2956	2601768e63b72839d4b5cd5e61b658ed.exe	29
PID 2956 wrote to memory of 1712	2956	2601768e63b72839d4b5cd5e61b658ed.exe	30
PID 2956 wrote to memory of 1712	2956	2601768e63b72839d4b5cd5e61b658ed.exe	30
PID 2956 wrote to memory of 1712	2956	2601768e63b72839d4b5cd5e61b658ed.exe	30

C:\Users\Admin\AppData\Local\Temp\2601768e63b72839d4b5cd5e61b658ed.exe
"C:\Users\Admin\AppData\Local\Temp\2601768e63b72839d4b5cd5e61b658ed.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color f
  2⤵
  PID:2992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause >nul
  2⤵
  PID:1712