1afe857d1b5f2c0ff48ebbd2f32abf11f9b310416b1273e77adc7ee37f001ff8

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 18:26

Target
Samples 1/5cc02305d7b5cb0675f2ac65422a115aa44d8f28e5a2b759470d17d6bf851a3a.exe
Size 940KB
Sample240107-w3ew5aceh9
SHA256 5cc02305d7b5cb0675f2ac65422a115aa44d8f28e5a2b759470d17d6bf851a3a
MD5 87fadafde153ec4d73a358c4897e54e6
SHA1 1745ada809a9e80f80ce8a38d2bb5858378a4206
SHA512 15331c1964c1abfcdd31e2c3b40a744b0e33bf7df5c9749be1047d384cf5d34e86655d16fba2601156c56178b8f0e3e90405a70bd22d2f5794ff948c16881b88
SSDEEP 12288:RCdOy3vVrKxR5CXbNjAOxK/j2n+4YG/6c1mFFja3mXgcjfRlgsUBgagHCZu8i7iq:RCdxte/80jYLT3U1jfsWaqeHfQ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3600	5cc02305d7b5cb0675f2ac65422a115aa44d8f28e5a2b759470d17d6bf851a3a.exe
3600	5cc02305d7b5cb0675f2ac65422a115aa44d8f28e5a2b759470d17d6bf851a3a.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3600	5cc02305d7b5cb0675f2ac65422a115aa44d8f28e5a2b759470d17d6bf851a3a.exe
3600	5cc02305d7b5cb0675f2ac65422a115aa44d8f28e5a2b759470d17d6bf851a3a.exe
3600	5cc02305d7b5cb0675f2ac65422a115aa44d8f28e5a2b759470d17d6bf851a3a.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3600	5cc02305d7b5cb0675f2ac65422a115aa44d8f28e5a2b759470d17d6bf851a3a.exe
3600	5cc02305d7b5cb0675f2ac65422a115aa44d8f28e5a2b759470d17d6bf851a3a.exe
3600	5cc02305d7b5cb0675f2ac65422a115aa44d8f28e5a2b759470d17d6bf851a3a.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 928	3600	5cc02305d7b5cb0675f2ac65422a115aa44d8f28e5a2b759470d17d6bf851a3a.exe	20
PID 3600 wrote to memory of 928	3600	5cc02305d7b5cb0675f2ac65422a115aa44d8f28e5a2b759470d17d6bf851a3a.exe	20
PID 3600 wrote to memory of 928	3600	5cc02305d7b5cb0675f2ac65422a115aa44d8f28e5a2b759470d17d6bf851a3a.exe	20

C:\Users\Admin\AppData\Local\Temp\Samples 1\5cc02305d7b5cb0675f2ac65422a115aa44d8f28e5a2b759470d17d6bf851a3a.exe
"C:\Users\Admin\AppData\Local\Temp\Samples 1\5cc02305d7b5cb0675f2ac65422a115aa44d8f28e5a2b759470d17d6bf851a3a.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /k set
  2⤵
  PID:928