703ef34b6d47c78754c8a1c2507993858d93106b42efd44af71a324ec7c983e1

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 19:43

Target

喜欢此软件_love it.exe
Size

66KB
MD5

d4d4be4bd56ed03eca031be8b8a9814c
SHA1

06d4aef8a831a883c5574d4b46c29df4b81992bf
SHA256

c90d9af17233a717fdb8b08d45749680efeca7046deef950ff1d4e987be68681
SHA512

75d5a6df561b4bbd497a45bb7feb4f11dce2b28eff93ec8ffe5cae0cdde0857f5346aa498bd908307f81c1f15cac088cdc1ba96434ef4a2d135bcf45063f96cf
SSDEEP

1536:JdBoWdHaDL1UOUc01anifKUYJFqLa4qpqR:JgWdHaDhocDGKU4t4qpqR

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 2296	4292	喜欢此软件_love it.exe	88
PID 4292 wrote to memory of 2296	4292	喜欢此软件_love it.exe	88
PID 4292 wrote to memory of 2296	4292	喜欢此软件_love it.exe	88

C:\Users\Admin\AppData\Local\Temp\喜欢此软件_love it.exe
"C:\Users\Admin\AppData\Local\Temp\喜欢此软件_love it.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bt66846.bat "C:\Users\Admin\AppData\Local\Temp\?????_love it.exe"
  2⤵
  PID:2296

C:\Users\Admin\AppData\Local\Temp\bt66846.bat

Filesize
225B

MD5
8b199a7b5885fc7be127f0fdba39140e

SHA1
0b3015371825ed1d02ceb79c7f5a4ee719ebe7a3

SHA256
7f9ffd0b55164fb619f9fc314726047df7620a7368b95fa7cc460ad3c0be135f

SHA512
430f2d098de2182aa4e592aa9d07e1c414468c4cfd9bac6ebc181596ff9f7a8a5f364e51428d8bab043d40633a804e12f880afbdbece7cb5779ed3f493fe924f

Download Submit
memory/4292-5-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download