091cef11e74e54f8036895cacaf381dd44d4150f30e1433d5a93dbe0d89b6c3c

Resubmissions

09/01/2024, 02:53

09/01/2024, 02:51

09/01/2024, 02:48

max time kernel
91s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 02:48

Target

MLvUvEDOEuKLTktpDCrXoFfYVFbxTEfqhGQYVnKCVdocogSLzLRgZCfRZLPrHCKVfddmhcuolTJEiAOTVsCNgjIcNKMUJOqsGRDI.exe
Size

374KB
MD5

9de24a3783de7801078ce41dde985fe3
SHA1

5c50528ec983cc2ef5434505e9c88f383f34664f
SHA256

091cef11e74e54f8036895cacaf381dd44d4150f30e1433d5a93dbe0d89b6c3c
SHA512

4fbe35b80443656d262cdd4f9202ec0b2ea72404a39e076df58c6a84962ac0b8ca8103c719d536a4fc89fcb9fddb68ed1c312bb974dadfeec4d5322acd17b959
SSDEEP

6144:Pcm6lZ+F3X+ffm8Qkt93qMMRoeYu4SCUXv0guGqwtI1r0f2OK4grp5/vlSaSMxi:PcmISXGmfktWGu4Mc7FQMxi

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2672	2500	SnippingTool.exe	31
PID 2500 wrote to memory of 2672	2500	SnippingTool.exe	31
PID 2500 wrote to memory of 2672	2500	SnippingTool.exe	31

C:\Users\Admin\AppData\Local\Temp\MLvUvEDOEuKLTktpDCrXoFfYVFbxTEfqhGQYVnKCVdocogSLzLRgZCfRZLPrHCKVfddmhcuolTJEiAOTVsCNgjIcNKMUJOqsGRDI.exe
"C:\Users\Admin\AppData\Local\Temp\MLvUvEDOEuKLTktpDCrXoFfYVFbxTEfqhGQYVnKCVdocogSLzLRgZCfRZLPrHCKVfddmhcuolTJEiAOTVsCNgjIcNKMUJOqsGRDI.exe"
1⤵
PID:2468

C:\Windows\system32\SnippingTool.exe
"C:\Windows\system32\SnippingTool.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\SYSTEM32\WISPTIS.EXE
  "C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch;
  2⤵
  PID:2672

memory/2468-0-0x0000000000370000-0x000000000040A000-memory.dmp

Filesize
616KB

Download
memory/2468-1-0x0000000073FD0000-0x00000000746BE000-memory.dmp

Filesize
6.9MB

Download
memory/2468-2-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download
memory/2468-3-0x0000000004D20000-0x0000000004D60000-memory.dmp

Filesize
256KB

Download
memory/2468-4-0x0000000073FD0000-0x00000000746BE000-memory.dmp

Filesize
6.9MB

Download
memory/2468-5-0x0000000004D20000-0x0000000004D60000-memory.dmp

Filesize
256KB

Download
memory/2500-7-0x00000000024A0000-0x00000000024A1000-memory.dmp

Filesize
4KB

Download
memory/2500-8-0x00000000024A0000-0x00000000024A1000-memory.dmp

Filesize
4KB

Download
memory/2672-6-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download