340c690cb87f7fb56a2459a63fb5ac8963df59a9e2b7398a96a634ba132ae6e4

Analysis

max time kernel
12s
max time network
17s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
11-12-2023 19:06

Target

InSenSe FN.exe
Size

995KB
MD5

6796dd93934044b2bd1d81d36a14cbb7
SHA1

287c8f1d0947bad43c18d690aa52c1611705cd44
SHA256

340c690cb87f7fb56a2459a63fb5ac8963df59a9e2b7398a96a634ba132ae6e4
SHA512

3e64073e7011de35944fe5846b63f330bb877c35ebc83220bc451c2eac8ff44af28367c74e66fe4667b6847faac90d2934f20a1fad33c6defb2789b0251295be
SSDEEP

24576:gldK5Uqy7acUyhsHzfRkn6JwiEuanNLZE:cdQjyWoCzf4W+nNVE

Score

1^/10

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 4836	1792	InSenSe FN.exe	88
PID 1792 wrote to memory of 4836	1792	InSenSe FN.exe	88
PID 4836 wrote to memory of 1888	4836	cmd.exe	89
PID 4836 wrote to memory of 1888	4836	cmd.exe	89
PID 1792 wrote to memory of 4364	1792	InSenSe FN.exe	90
PID 1792 wrote to memory of 4364	1792	InSenSe FN.exe	90
PID 4364 wrote to memory of 1536	4364	cmd.exe	91
PID 4364 wrote to memory of 1536	4364	cmd.exe	91
PID 4364 wrote to memory of 4456	4364	cmd.exe	93
PID 4364 wrote to memory of 4456	4364	cmd.exe	93
PID 4364 wrote to memory of 388	4364	cmd.exe	92
PID 4364 wrote to memory of 388	4364	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\InSenSe FN.exe
"C:\Users\Admin\AppData\Local\Temp\InSenSe FN.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mode con cols=60 lines=10
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Windows\system32\mode.com
    mode con cols=60 lines=10
    3⤵
    PID:1888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\InSenSe FN.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\InSenSe FN.exe" MD5
    3⤵
    PID:1536
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:388
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:4456