debd455391888928a84ae3fbc58d6bf40eb739c5caffe3d68c5c5e2734970186

Resubmissions

25/01/2024, 22:26

25/01/2024, 17:53

25/01/2024, 17:25

max time kernel
77s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 22:26

Target
Meet.exe
Size 469.8MB
Sample240125-2cwpvahehm
SHA256 debd455391888928a84ae3fbc58d6bf40eb739c5caffe3d68c5c5e2734970186
MD5 4f44f506dc54a3e6ecc2da93bc5966f5
SHA1 2a6671f8be6d2d5c09093f9a2715eb7a4aaba44b
SHA512 2821ec7493bd3cfb16bb59d06abf3907072a9ac50c3783208776c6c1e321eadc1b7640d398c113cb96ada33205981b6d43f17ce9ee3924ca2a72b28e50f42fbd
SSDEEP 6291456:3LN6SRoiJjOen+zQtaEeaszZv1xKRl35DCSpWgUPNlP/ikfuc5MYyGFNCx:3LN6SLJjOen3t+32pDZl6NxBlDY
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3944	Meet.exe
3944	Meet.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 3944	1616	Meet.exe	89
PID 1616 wrote to memory of 3944	1616	Meet.exe	89

C:\Users\Admin\AppData\Local\Temp\Meet.exe
"C:\Users\Admin\AppData\Local\Temp\Meet.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Users\Admin\AppData\Local\Temp\Meet.exe
  C:\Users\Admin\AppData\Local\Temp\Meet.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3944

memory/1616-1-0x00007FF60FC10000-0x00007FF610C10000-memory.dmp

Download

memory/3944-0-0x00007FF60FC10000-0x00007FF610C10000-memory.dmp

Download