05c9c456cad09ae6bf8f5a879a0c86ccc94a5b987e14b4e3c1433672897e2577

Analysis

max time kernel
143s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
02/01/2024, 14:47

Target

05c9c456cad09ae6bf8f5a879a0c86ccc94a5b987e14b4e3c1433672897e2577.exe
Size

157KB
MD5

b6bbdd51556f752b034a1a74f54808e2
SHA1

5d300ea856c27974dbd7b58401141c303b1db608
SHA256

05c9c456cad09ae6bf8f5a879a0c86ccc94a5b987e14b4e3c1433672897e2577
SHA512

e69a3f2b3c4aa2085d69aa1860409aab89c0307070b53ab03bcc66aba154f10c80f34785d272c08bc43fb75be40b3fea07d10a1c4bb7c9566a7a0012c57b850c
SSDEEP

3072:Z/25jvDSgsqsb5Uh28vAbTV1WW69B9VjMdxPedN9ug0z9TBfFSZlR:0tzsb5Uh28+V1WW69B9VjMdxPedN9ugd

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 1748	4704	05c9c456cad09ae6bf8f5a879a0c86ccc94a5b987e14b4e3c1433672897e2577.exe	18
PID 4704 wrote to memory of 1748	4704	05c9c456cad09ae6bf8f5a879a0c86ccc94a5b987e14b4e3c1433672897e2577.exe	18
PID 1748 wrote to memory of 3600	1748	cmd.exe	17
PID 1748 wrote to memory of 3600	1748	cmd.exe	17

C:\Users\Admin\AppData\Local\Temp\05c9c456cad09ae6bf8f5a879a0c86ccc94a5b987e14b4e3c1433672897e2577.exe
"C:\Users\Admin\AppData\Local\Temp\05c9c456cad09ae6bf8f5a879a0c86ccc94a5b987e14b4e3c1433672897e2577.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\52F2.tmp\52F3.tmp\52F4.bat C:\Users\Admin\AppData\Local\Temp\05c9c456cad09ae6bf8f5a879a0c86ccc94a5b987e14b4e3c1433672897e2577.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1748