cf2cf07ae829eacca9bc23c98c39171e7b3e11f5a194404638d1ce807296d9f0

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 04:44

Target

05e157efc0997b2ec225222757247265.exe
Size

25KB
MD5

05e157efc0997b2ec225222757247265
SHA1

ff9402a5e0aaf5dd75ea93b4a1422c45dceb9947
SHA256

cf2cf07ae829eacca9bc23c98c39171e7b3e11f5a194404638d1ce807296d9f0
SHA512

01bc8699872d9c357618d70480b71460a67e49972feaff324d7613ddf1d9f7298b92866e35c6031e8a3d2032658eaf6b913b6c102b9f5be22652882fa653f665
SSDEEP

384:I/wJ7n4nRuyM2nrRcHkoHi3Qc/i6wNdzBGjoLgfBJ5/2vRgAq8Mx7nd2Lf:jZn4RQkrRtn/ENdBLgfP5/2Zg788nd

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3340 wrote to memory of 3148	3340	05e157efc0997b2ec225222757247265.exe	18
PID 3340 wrote to memory of 3148	3340	05e157efc0997b2ec225222757247265.exe	18
PID 3340 wrote to memory of 3148	3340	05e157efc0997b2ec225222757247265.exe	18

C:\Users\Admin\AppData\Local\Temp\05e157efc0997b2ec225222757247265.exe
"C:\Users\Admin\AppData\Local\Temp\05e157efc0997b2ec225222757247265.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$cvbdfgrdfg.bat
  2⤵
  PID:3148

memory/3340-0-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3340-3-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download