05c9c456cad09ae6bf8f5a879a0c86ccc94a5b987e14b4e3c1433672897e2577

Analysis

max time kernel
139s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12-01-2024 22:38

Target

05c9c456cad09ae6bf8f5a879a0c86ccc94a5b987e14b4e3c1433672897e2577.exe
Size

157KB
MD5

b6bbdd51556f752b034a1a74f54808e2
SHA1

5d300ea856c27974dbd7b58401141c303b1db608
SHA256

05c9c456cad09ae6bf8f5a879a0c86ccc94a5b987e14b4e3c1433672897e2577
SHA512

e69a3f2b3c4aa2085d69aa1860409aab89c0307070b53ab03bcc66aba154f10c80f34785d272c08bc43fb75be40b3fea07d10a1c4bb7c9566a7a0012c57b850c
SSDEEP

3072:Z/25jvDSgsqsb5Uh28vAbTV1WW69B9VjMdxPedN9ug0z9TBfFSZlR:0tzsb5Uh28+V1WW69B9VjMdxPedN9ugd

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3728 wrote to memory of 2824	3728	05c9c456cad09ae6bf8f5a879a0c86ccc94a5b987e14b4e3c1433672897e2577.exe	17
PID 3728 wrote to memory of 2824	3728	05c9c456cad09ae6bf8f5a879a0c86ccc94a5b987e14b4e3c1433672897e2577.exe	17
PID 2824 wrote to memory of 2424	2824	cmd.exe	19
PID 2824 wrote to memory of 2424	2824	cmd.exe	19

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\3DA5.tmp\3DA6.tmp\3DA7.bat C:\Users\Admin\AppData\Local\Temp\05c9c456cad09ae6bf8f5a879a0c86ccc94a5b987e14b4e3c1433672897e2577.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\system32\fsutil.exe
  fsutil dirty query C:
  2⤵
  PID:2424

C:\Users\Admin\AppData\Local\Temp\05c9c456cad09ae6bf8f5a879a0c86ccc94a5b987e14b4e3c1433672897e2577.exe
"C:\Users\Admin\AppData\Local\Temp\05c9c456cad09ae6bf8f5a879a0c86ccc94a5b987e14b4e3c1433672897e2577.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3728