3618684bb89690c9a3395e4b1ada4dad0cc3c2028b62e2642f48bbac322263e1

Analysis

max time kernel
141s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 13:29

Target

21d320388ebe5e990dbf14acb315642d.exe
Size

56KB
MD5

21d320388ebe5e990dbf14acb315642d
SHA1

f03564d29f50ec8aa6806212b1e23a04fe49498f
SHA256

3618684bb89690c9a3395e4b1ada4dad0cc3c2028b62e2642f48bbac322263e1
SHA512

8a5b79352d39e34c6511505be577093bc82659ab2b691b616a5e9d9ad4e0382d6dc8ef924ad14d072edd93ff2444ff60bf260892dde5b6524d23f15be3156e48
SSDEEP

768:vCru/f9Iw/E6zy4n8uZ5tUXMJ+fROUmELY2glEbM3j+rd+fpRiTWNReOO2:71Tzy48untU8fOMEI3jyYfPiuO2

Score

1^/10

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 3328	4572	21d320388ebe5e990dbf14acb315642d.exe	24
PID 4572 wrote to memory of 3328	4572	21d320388ebe5e990dbf14acb315642d.exe	24
PID 4572 wrote to memory of 3328	4572	21d320388ebe5e990dbf14acb315642d.exe	24
PID 3328 wrote to memory of 220	3328	cmd.exe	23
PID 3328 wrote to memory of 220	3328	cmd.exe	23
PID 3328 wrote to memory of 220	3328	cmd.exe	23
PID 220 wrote to memory of 4312	220	iexpress.exe	22
PID 220 wrote to memory of 4312	220	iexpress.exe	22
PID 220 wrote to memory of 4312	220	iexpress.exe	22

C:\Users\Admin\AppData\Local\Temp\21d320388ebe5e990dbf14acb315642d.exe
"C:\Users\Admin\AppData\Local\Temp\21d320388ebe5e990dbf14acb315642d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3C5D.tmp\1.bat" "C:\Users\Admin\AppData\Local\Temp\21d320388ebe5e990dbf14acb315642d.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3328

C:\Windows\SysWOW64\makecab.exe
C:\Windows\SysWOW64\makecab.exe /f "~%TargetName%.DDF"
1⤵
PID:4312

C:\Windows\SysWOW64\iexpress.exe
iexpress /n /q /m C:\Users\Admin\AppData\Local\Temp\popup.sed
1⤵
- Suspicious use of WriteProcessMemory
PID:220