f8c9828ed05f0f8795ce13945f86c812863ba14be17696631579f43155a25111

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 11:53

Target

1c4636dbbe020967242242de2d355e01.exe
Size

26KB
MD5

1c4636dbbe020967242242de2d355e01
SHA1

547623ac659de55b35930e416af6288b90f1c01d
SHA256

f8c9828ed05f0f8795ce13945f86c812863ba14be17696631579f43155a25111
SHA512

23b513b55423890d05ce0f58c4872b4f8ea5fc8f81ef0467021091c71e7754e45e4bd8665948f467b0a3523716cc7a4282b310fe1d9c17b3014965ccade00654
SSDEEP

384:OKMMjtnMgBLKM2ES29CKnIkIQjQxc9bo6Pvjz+nIFqkQYMNMjsow1w6SHGOgPGwF:mM9+qn8QyP6DanIXImaTSmOg+wlYY

Score

1^/10

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 4992	4976	1c4636dbbe020967242242de2d355e01.exe	36
PID 4976 wrote to memory of 4992	4976	1c4636dbbe020967242242de2d355e01.exe	36
PID 4976 wrote to memory of 4992	4976	1c4636dbbe020967242242de2d355e01.exe	36
PID 4976 wrote to memory of 1876	4976	1c4636dbbe020967242242de2d355e01.exe	87
PID 4976 wrote to memory of 1876	4976	1c4636dbbe020967242242de2d355e01.exe	87
PID 4976 wrote to memory of 1876	4976	1c4636dbbe020967242242de2d355e01.exe	87
PID 4976 wrote to memory of 3156	4976	1c4636dbbe020967242242de2d355e01.exe	96
PID 4976 wrote to memory of 3156	4976	1c4636dbbe020967242242de2d355e01.exe	96
PID 4976 wrote to memory of 3156	4976	1c4636dbbe020967242242de2d355e01.exe	96
PID 4976 wrote to memory of 4120	4976	1c4636dbbe020967242242de2d355e01.exe	97
PID 4976 wrote to memory of 4120	4976	1c4636dbbe020967242242de2d355e01.exe	97
PID 4976 wrote to memory of 4120	4976	1c4636dbbe020967242242de2d355e01.exe	97
PID 4976 wrote to memory of 2488	4976	1c4636dbbe020967242242de2d355e01.exe	98
PID 4976 wrote to memory of 2488	4976	1c4636dbbe020967242242de2d355e01.exe	98
PID 4976 wrote to memory of 2488	4976	1c4636dbbe020967242242de2d355e01.exe	98

C:\Users\Admin\AppData\Local\Temp\1c4636dbbe020967242242de2d355e01.exe
"C:\Users\Admin\AppData\Local\Temp\1c4636dbbe020967242242de2d355e01.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color A
  2⤵
  PID:4992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:1876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color C
  2⤵
  PID:3156
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color D
  2⤵
  PID:4120
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color E
  2⤵
  PID:2488