c8c3f7de3eabed01f372f9b984aba21bf0412ce985a13514b8274113511891aa

Analysis

max time kernel
146s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
05/01/2024, 01:27

Target

426a2144a5889f6733983210311087f6.exe
Size

20KB
MD5

426a2144a5889f6733983210311087f6
SHA1

e2ae7d9c00f1eb951d9cca3a5c2026e01a273897
SHA256

c8c3f7de3eabed01f372f9b984aba21bf0412ce985a13514b8274113511891aa
SHA512

bec8ada0466f5ae16d7737626498a0b0f258cb414c5b65267e73d5f2c31fa9fda41c9be62dcff06c51ee11e8bcbfb6c2c6723ea15264523bd6091433007a5658
SSDEEP

384:YgBIrIV/Y/aDhtwyG5q3nXTmwKa2TarlalaIyqWpQ9DXT5pEupKd4gZQQKGVSDR:LOrsOaDg4XRrlalG69X5mu2TZZKG4V

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 2884	3480	426a2144a5889f6733983210311087f6.exe	21
PID 3480 wrote to memory of 2884	3480	426a2144a5889f6733983210311087f6.exe	21
PID 3480 wrote to memory of 2884	3480	426a2144a5889f6733983210311087f6.exe	21

C:\Users\Admin\AppData\Local\Temp\426a2144a5889f6733983210311087f6.exe
"C:\Users\Admin\AppData\Local\Temp\426a2144a5889f6733983210311087f6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\b.bat "C:\Users\Admin\AppData\Local\Temp\426a2144a5889f6733983210311087f6.exe"
  2⤵
  PID:2884