09d57499ccc37a72b41e71276baec6ca334d834789b46fc2a7765a1142bb1c6f

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 17:43

Target
31d3aa1499d9d26a1f7df2ea9a88983f.exe
Size 95KB
Sample231225-war1zsffcm
SHA256 09d57499ccc37a72b41e71276baec6ca334d834789b46fc2a7765a1142bb1c6f
MD5 31d3aa1499d9d26a1f7df2ea9a88983f
SHA1 a42a60c5e70a54c7912df2f273deb0a4169e4f20
SHA512 99279ab3ac65cc1adf249804680fd5d9740907192884c0591ea4ec361c9534a8983f41f4c15251d1bdc5f2bed4a45b9dd6f11659a155a3fb7c40469945d31ef7
SSDEEP 1536:1QQ2aTmnPfYc9Yh8Op3MrfENGaIkaN7ZG5az2I95:1QQ2aSPBGCOp3mEjIk47UfI95
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 5036	4716	31d3aa1499d9d26a1f7df2ea9a88983f.exe	92
PID 4716 wrote to memory of 5036	4716	31d3aa1499d9d26a1f7df2ea9a88983f.exe	92
PID 4716 wrote to memory of 5036	4716	31d3aa1499d9d26a1f7df2ea9a88983f.exe	92

C:\Users\Admin\AppData\Local\Temp\31d3aa1499d9d26a1f7df2ea9a88983f.exe
"C:\Users\Admin\AppData\Local\Temp\31d3aa1499d9d26a1f7df2ea9a88983f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\~4FC6.BAT" "C:\Users\Admin\AppData\Local\Temp\31d3aa1499d9d26a1f7df2ea9a88983f.exe""
  2⤵
  PID:5036

~4FC6.BAT

Path C:\Users\Admin\AppData\Local\Temp\~4FC6.BAT
Size 794B
SHA256 01e5b215a44dbc44ea6611315690bed108e0ba3f027367e9b9ee81f5c1b6308f
MD5 21a58faefc1eb815eee54975c63a02b8
SHA1 4bfaa99f3719af4e9cff08fa07193da4067f445c
SHA512 e236401e317e520b8e207e576238858d3919bd1dadebe65a4101a054e184cfbbe5855eb5ce36436d9e1bed3d12b91ab435b77c0e975008ee6e44e49244ac3718
MD5 SHA1 SHA512

Submit Download

memory/4716-3-0x0000000000400000-0x0000000000423000-memory.dmp

Download