e7341b609e705737d997fac15721bc3bc0ca1906937dc5f21ca49fca39f198c7

Analysis

max time kernel
143s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2024, 16:26

Target
b523e58222204580bd70430e7f29c13b.exe
Size 536KB
Sample240305-txhpqaba9z
SHA256 e7341b609e705737d997fac15721bc3bc0ca1906937dc5f21ca49fca39f198c7
MD5 b523e58222204580bd70430e7f29c13b
SHA1 360e29f530fca3f982cbe23d029eacbf9bdb802e
SHA512 f67ba81a5f033f75fa1b7503ae573e852abf4c5d53ce5c1b965541dadf2d30370bda6579f753a6d0bbe8abb096c74076e95ac5d8f2dde263fa9c9270375b787f
SSDEEP 12288:n12Wx2XwW6wBnwZZD44sgJePo5n3EnF0T0WwE7GF6:nJ2Xh1nOeQxmI0IiF6
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 3612	4800	b523e58222204580bd70430e7f29c13b.exe	91
PID 4800 wrote to memory of 3612	4800	b523e58222204580bd70430e7f29c13b.exe	91
PID 4800 wrote to memory of 3612	4800	b523e58222204580bd70430e7f29c13b.exe	91

C:\Users\Admin\AppData\Local\Temp\b523e58222204580bd70430e7f29c13b.exe
"C:\Users\Admin\AppData\Local\Temp\b523e58222204580bd70430e7f29c13b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$306508.bat
  2⤵
  PID:3612

$$306508.bat

Path C:\Users\Admin\AppData\Local\Temp\$$306508.bat
Size 182B
SHA256 5737a128872b86480f44db9799bd4c593c7ff87b49db79cadfcc30c988d1025d
MD5 4bd3fe4eebdb0fcf604d0ea85cc49d6c
SHA1 7470bb7cbed368f3c244bc85a312db51b6400526
SHA512 15b0051a8f304bdde2960345d189b9ef6c9b8991559e6455795e98f869bccf78eab544106edaf6b0121073006386cca6815b7b1de8de5fdd4a9642cf044fbd26
MD5 SHA1 SHA512

Submit Download

memory/4800-0-0x0000000002430000-0x0000000002431000-memory.dmp

Download

memory/4800-3-0x0000000000400000-0x000000000059E000-memory.dmp

Download