2ce5319dfd885b1977c0772ab718854bab7ae7ac85898a75984f64b99280a74e

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07-01-2024 08:43

Target

48864968e0e2b10cc92dabd52aa1210a.exe
Size

156KB
MD5

48864968e0e2b10cc92dabd52aa1210a
SHA1

4a833d7a67a245f41aa09a64217d871b4ccbeef4
SHA256

2ce5319dfd885b1977c0772ab718854bab7ae7ac85898a75984f64b99280a74e
SHA512

c45fcb0547b179d33e11cdeaf83fc5d9e6a2301c344e371959240396bbc6fdf58d3b4f326827946de5704f632e9140c3d62a3e4fdc9a06bb66e79c7158a2015a
SSDEEP

3072:E57rjbYZIoOiwcg0JC03c6HglIOOc6HcT66vlmMD9aIn40Duq5jjM72ccc3kc3Jf:07bYZbrwr0c03c6Hfxc6HcT66vlmMD9S

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 4156	3248	48864968e0e2b10cc92dabd52aa1210a.exe	16
PID 3248 wrote to memory of 4156	3248	48864968e0e2b10cc92dabd52aa1210a.exe	16
PID 3248 wrote to memory of 4156	3248	48864968e0e2b10cc92dabd52aa1210a.exe	16

C:\Users\Admin\AppData\Local\Temp\48864968e0e2b10cc92dabd52aa1210a.exe
"C:\Users\Admin\AppData\Local\Temp\48864968e0e2b10cc92dabd52aa1210a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4156

memory/3248-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download