caa6207b329e6097cc9ebd1eaa240fa79d2b9f75f4d8608b4936400262ad8d80

Analysis

max time kernel
138s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 08:16

Target

13304455eae5a2a98391ebcb64afd7ac.exe
Size

56KB
MD5

13304455eae5a2a98391ebcb64afd7ac
SHA1

c845c998cc4158d3a56ebda85c855440491f5e3c
SHA256

caa6207b329e6097cc9ebd1eaa240fa79d2b9f75f4d8608b4936400262ad8d80
SHA512

af39789ea27a8b1ac5f593aed7454d03de9ce4d7c2d4b0ee83542885d391a88ec00936011129f2f7d13eb8ce4eb5baeef447f93e589f82a57b5e77bc7c8bafd2
SSDEEP

768:vCru/f9Iw/E6zy4n8uZ5tUXMJ+fROUmELY2glEbM3j+rd+fpRiTWNReOOP:71Tzy48untU8fOMEI3jyYfPiuOP

Score

1^/10

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 212 wrote to memory of 4868	212	13304455eae5a2a98391ebcb64afd7ac.exe	17
PID 212 wrote to memory of 4868	212	13304455eae5a2a98391ebcb64afd7ac.exe	17
PID 212 wrote to memory of 4868	212	13304455eae5a2a98391ebcb64afd7ac.exe	17
PID 4868 wrote to memory of 4952	4868	cmd.exe	23
PID 4868 wrote to memory of 4952	4868	cmd.exe	23
PID 4868 wrote to memory of 4952	4868	cmd.exe	23
PID 4952 wrote to memory of 4204	4952	iexpress.exe	22
PID 4952 wrote to memory of 4204	4952	iexpress.exe	22
PID 4952 wrote to memory of 4204	4952	iexpress.exe	22

C:\Users\Admin\AppData\Local\Temp\13304455eae5a2a98391ebcb64afd7ac.exe
"C:\Users\Admin\AppData\Local\Temp\13304455eae5a2a98391ebcb64afd7ac.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4E01.tmp\1.bat" "C:\Users\Admin\AppData\Local\Temp\13304455eae5a2a98391ebcb64afd7ac.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Windows\SysWOW64\iexpress.exe
    iexpress /n /q /m C:\Users\Admin\AppData\Local\Temp\popup.sed
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4952

C:\Windows\SysWOW64\makecab.exe
C:\Windows\SysWOW64\makecab.exe /f "~%TargetName%.DDF"
1⤵
PID:4204