e1912a843c38b78761c260c2b16ead02515982ac1b91cd4cc1003452f2cc10c0

Analysis

max time kernel
144s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 09:28

Target

63c85df0a19f9795dbb99cae25109ffc.exe
Size

92KB
MD5

63c85df0a19f9795dbb99cae25109ffc
SHA1

612cbe1e768f448dcd00cd47dbfb815f173de0ee
SHA256

e1912a843c38b78761c260c2b16ead02515982ac1b91cd4cc1003452f2cc10c0
SHA512

e3cc117860e1ee6caabd23e22c918b4d3add6b31e9361b2bd5db37814d6292e0e907fadb787cf62bab08338785e289ed135c35cc42df40aa011f5c03b8a6fe5f
SSDEEP

1536:+VZfqamsNbDFJ8dztd11111111Y1111111vw1+1shsrtWztERw37Y33333Y3333L:+VZSaZxDFJWztw+itWzI7H0

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 3792	1484	63c85df0a19f9795dbb99cae25109ffc.exe	90
PID 1484 wrote to memory of 3792	1484	63c85df0a19f9795dbb99cae25109ffc.exe	90
PID 1484 wrote to memory of 3792	1484	63c85df0a19f9795dbb99cae25109ffc.exe	90

C:\Users\Admin\AppData\Local\Temp\63c85df0a19f9795dbb99cae25109ffc.exe
"C:\Users\Admin\AppData\Local\Temp\63c85df0a19f9795dbb99cae25109ffc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CX8XBC4S.bat" "C:\Users\Admin\AppData\Local\Temp\63c85df0a19f9795dbb99cae25109ffc.exe""
  2⤵
  PID:3792

C:\Users\Admin\AppData\Local\Temp\CX8XBC4S.bat

Filesize
1KB

MD5
9940470efe6034eaa7ccf72d9821bff0

SHA1
bf447bd69782d6e5087ba1c0f08ac351a66c3f1e

SHA256
cdac5fac868d19a23ebbfe5e03c8fff19dad36e055f4f172ce74b9d01aac2837

SHA512
99a8ea57e0e1ee590f2f6e80ed93b1f44c90470775703c2a266b56c98e307f49a23dde6b7819de63f5769098cca66dfddc067915110dbe2a4339536a0d160d48

Download Submit
memory/1484-3-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download