cf2cf07ae829eacca9bc23c98c39171e7b3e11f5a194404638d1ce807296d9f0

Analysis

max time kernel
156s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 22:39

Target

05e157efc0997b2ec225222757247265.exe
Size

25KB
MD5

05e157efc0997b2ec225222757247265
SHA1

ff9402a5e0aaf5dd75ea93b4a1422c45dceb9947
SHA256

cf2cf07ae829eacca9bc23c98c39171e7b3e11f5a194404638d1ce807296d9f0
SHA512

01bc8699872d9c357618d70480b71460a67e49972feaff324d7613ddf1d9f7298b92866e35c6031e8a3d2032658eaf6b913b6c102b9f5be22652882fa653f665
SSDEEP

384:I/wJ7n4nRuyM2nrRcHkoHi3Qc/i6wNdzBGjoLgfBJ5/2vRgAq8Mx7nd2Lf:jZn4RQkrRtn/ENdBLgfP5/2Zg788nd

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 3148	4596	05e157efc0997b2ec225222757247265.exe	52
PID 4596 wrote to memory of 3148	4596	05e157efc0997b2ec225222757247265.exe	52
PID 4596 wrote to memory of 3148	4596	05e157efc0997b2ec225222757247265.exe	52

C:\Users\Admin\AppData\Local\Temp\05e157efc0997b2ec225222757247265.exe
"C:\Users\Admin\AppData\Local\Temp\05e157efc0997b2ec225222757247265.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$cvbdfgrdfg.bat
  2⤵
  PID:3148

C:\Users\Admin\AppData\Local\Temp\$cvbdfgrdfg.bat

Filesize
181B

MD5
2733eb34f7dba0ce0079108128d47ac2

SHA1
ec5b996ac48db4180999685f929ec1e3a59c21d6

SHA256
bd6fdfa73dd2b546c5452e802fb836cfe1e356737c076fe7c253f500ebe8591e

SHA512
9c0a834bf50c4064ce9cfc93e3451b2f918075722702ab0bdd8e928b9eca3ed10034e1d05a42ccec7d05201e633d8af00cf9be54becac37dc9d957627e997dab

Download Submit
memory/4596-0-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4596-3-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download