05c9c456cad09ae6bf8f5a879a0c86ccc94a5b987e14b4e3c1433672897e2577

Analysis

max time kernel
144s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
01-01-2024 04:01

Target

b6bbdd51556f752b034a1a74f54808e2.exe
Size

157KB
MD5

b6bbdd51556f752b034a1a74f54808e2
SHA1

5d300ea856c27974dbd7b58401141c303b1db608
SHA256

05c9c456cad09ae6bf8f5a879a0c86ccc94a5b987e14b4e3c1433672897e2577
SHA512

e69a3f2b3c4aa2085d69aa1860409aab89c0307070b53ab03bcc66aba154f10c80f34785d272c08bc43fb75be40b3fea07d10a1c4bb7c9566a7a0012c57b850c
SSDEEP

3072:Z/25jvDSgsqsb5Uh28vAbTV1WW69B9VjMdxPedN9ug0z9TBfFSZlR:0tzsb5Uh28+V1WW69B9VjMdxPedN9ugd

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 1416	1672	b6bbdd51556f752b034a1a74f54808e2.exe	18
PID 1672 wrote to memory of 1416	1672	b6bbdd51556f752b034a1a74f54808e2.exe	18
PID 1416 wrote to memory of 2776	1416	cmd.exe	17
PID 1416 wrote to memory of 2776	1416	cmd.exe	17

C:\Users\Admin\AppData\Local\Temp\b6bbdd51556f752b034a1a74f54808e2.exe
"C:\Users\Admin\AppData\Local\Temp\b6bbdd51556f752b034a1a74f54808e2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\4F49.tmp\4F4A.tmp\4F4B.bat C:\Users\Admin\AppData\Local\Temp\b6bbdd51556f752b034a1a74f54808e2.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1416

C:\Users\Admin\AppData\Local\Temp\4F49.tmp\4F4A.tmp\4F4B.bat

Filesize
4KB

MD5
352624356f36096186e2a1a232d2d82c

SHA1
b6cc3780ae2b263a8f4dd1bc3f268c063a07d169

SHA256
4c7f7b8ce59254d77181c4edfc693c6e7ae8e1d26ace9a18cb81cf9345229aa8

SHA512
9aabec2f9d5c1945ca089b2b60a982373bbb952664bed3958bbef0e266623a37ffee9c784eab3533dd5fdffeffc2911f27bdcc59917e39ae9e16b9e2371a943b

Download Submit