83ec5b0f497d3c3763d37db667ca7ef867456608f54eac6dbc0f49b9158af23d

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2024, 08:52

Target

79cd535faa0478334d1d2a679e7a75c5.exe
Size

26KB
MD5

79cd535faa0478334d1d2a679e7a75c5
SHA1

7ca0d3e363ffbb7fcb09df8cfe1d6d6a9814ed22
SHA256

83ec5b0f497d3c3763d37db667ca7ef867456608f54eac6dbc0f49b9158af23d
SHA512

5cb832febab9d013e6f3ddd52c1b0964a30e31d95262636c4e505f5bd5b89f03d5631399b9ecb251e99d4f151b7198911fd1fb3690c1efd2757d11d3989fc5c7
SSDEEP

384:OKMMjtnMgBLKM2ES29CKnIkIQjQxc9bo6Pvjz+nIFqkQYMNMjsow1w6SHGOgPGww:mM9+qn8QyP6DanIXImaTSmOg+wlY9

Score

1^/10

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 1928	2792	79cd535faa0478334d1d2a679e7a75c5.exe	85
PID 2792 wrote to memory of 1928	2792	79cd535faa0478334d1d2a679e7a75c5.exe	85
PID 2792 wrote to memory of 1928	2792	79cd535faa0478334d1d2a679e7a75c5.exe	85
PID 2792 wrote to memory of 1436	2792	79cd535faa0478334d1d2a679e7a75c5.exe	89
PID 2792 wrote to memory of 1436	2792	79cd535faa0478334d1d2a679e7a75c5.exe	89
PID 2792 wrote to memory of 1436	2792	79cd535faa0478334d1d2a679e7a75c5.exe	89
PID 2792 wrote to memory of 4080	2792	79cd535faa0478334d1d2a679e7a75c5.exe	90
PID 2792 wrote to memory of 4080	2792	79cd535faa0478334d1d2a679e7a75c5.exe	90
PID 2792 wrote to memory of 4080	2792	79cd535faa0478334d1d2a679e7a75c5.exe	90
PID 2792 wrote to memory of 3304	2792	79cd535faa0478334d1d2a679e7a75c5.exe	92
PID 2792 wrote to memory of 3304	2792	79cd535faa0478334d1d2a679e7a75c5.exe	92
PID 2792 wrote to memory of 3304	2792	79cd535faa0478334d1d2a679e7a75c5.exe	92
PID 2792 wrote to memory of 3704	2792	79cd535faa0478334d1d2a679e7a75c5.exe	93
PID 2792 wrote to memory of 3704	2792	79cd535faa0478334d1d2a679e7a75c5.exe	93
PID 2792 wrote to memory of 3704	2792	79cd535faa0478334d1d2a679e7a75c5.exe	93

C:\Users\Admin\AppData\Local\Temp\79cd535faa0478334d1d2a679e7a75c5.exe
"C:\Users\Admin\AppData\Local\Temp\79cd535faa0478334d1d2a679e7a75c5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color A
  2⤵
  PID:1928
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color B
  2⤵
  PID:1436
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color C
  2⤵
  PID:4080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color D
  2⤵
  PID:3304
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Color E
  2⤵
  PID:3704