9f2bfb93647496f466b54b7b5405db565fb23b51b71f0fd97d034b24113d4b93

Analysis

max time kernel
138s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2024, 06:55

Target
c_test.exe
Size 7.0MB
Sample240104-hpsdeaaffk
SHA256 9f2bfb93647496f466b54b7b5405db565fb23b51b71f0fd97d034b24113d4b93
MD5 fdcfa3aa61fe2ed1ee6967ca9824c427
SHA1 2519ac8a1e4ed438cf3bff8b0be0b84125b1e02a
SHA512 b1a47c06c24d9561c5fd471ad1c0cca0f2e4450a0268af485ac6910b8e96942ab0bad15632f23218f9a803ea79fd3822c6190722f44253fd146b8c808df81ac4
SSDEEP 196608:xHure1W903eV4Q2tpDjIIAcwD0RPgvvk9LIL:+EW+eGQi9jo0Rk
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Loads dropped DLL 4 IoCs

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2876	c_test.exe
2876	c_test.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 2876	3664	c_test.exe	22
PID 3664 wrote to memory of 2876	3664	c_test.exe	22

C:\Users\Admin\AppData\Local\Temp\c_test.exe
"C:\Users\Admin\AppData\Local\Temp\c_test.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Users\Admin\AppData\Local\Temp\c_test.exe
  "C:\Users\Admin\AppData\Local\Temp\c_test.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2876