be6b83a038df8a126bc662ad479607b5ee4973b01a9d40236c07921fc1a09c00

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 06:09

Target

10b86f4ba1fec13fdded3c3f2e0d8ed1.exe
Size

3.5MB
MD5

10b86f4ba1fec13fdded3c3f2e0d8ed1
SHA1

74745c7ee392f10d9c622a1514566b052b50145c
SHA256

be6b83a038df8a126bc662ad479607b5ee4973b01a9d40236c07921fc1a09c00
SHA512

e9457f008d57e751f2a60972f0b9e79fa6aba89385ab534deff21e98dbc39b4475e3a4f752e2bcc1c8f39c78408ebbb0094ca697ea1a2206deb3ef480d532269
SSDEEP

49152:3GtlqO/IU6i5AOFQfdTRrc3uvUxJi7yVOkgz55oxN+CLtqgllGgXBCgYrwbiPElL:v+56c3uvUuvOPVXBCnwDleDCyAT3w

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 3640	4872	10b86f4ba1fec13fdded3c3f2e0d8ed1.exe	92
PID 4872 wrote to memory of 3640	4872	10b86f4ba1fec13fdded3c3f2e0d8ed1.exe	92

C:\Users\Admin\AppData\Local\Temp\10b86f4ba1fec13fdded3c3f2e0d8ed1.exe
"C:\Users\Admin\AppData\Local\Temp\10b86f4ba1fec13fdded3c3f2e0d8ed1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3640