e0d56c70573b760caa6ac2593eec067cbe783a85143b5326dfd1abd4c898cb34

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 10:57

Target
b73e1db94bb8a001b82461238e79b8f1.exe
Size 666KB
Sample240306-m2dg8sae68
SHA256 e0d56c70573b760caa6ac2593eec067cbe783a85143b5326dfd1abd4c898cb34
MD5 b73e1db94bb8a001b82461238e79b8f1
SHA1 28bab8663e702bd26c4ac35feed79e8d48a90e0f
SHA512 50a5f181c089a50b2a595885252038b016ba321766fa8dfdc1255858b30380835e9634566c2668013c285d986f1f41e0b41f856ef9099e175484cdcba127b345
SSDEEP 12288:lXXwAuNgFfsXxS5R3arw45zI4pVBM51cHeDKUL7QJs/a:1AHg6Xx2qcdMBMzcHneQ3
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 3648	3952	b73e1db94bb8a001b82461238e79b8f1.exe	92
PID 3952 wrote to memory of 3648	3952	b73e1db94bb8a001b82461238e79b8f1.exe	92
PID 3952 wrote to memory of 3648	3952	b73e1db94bb8a001b82461238e79b8f1.exe	92

C:\Users\Admin\AppData\Local\Temp\b73e1db94bb8a001b82461238e79b8f1.exe
"C:\Users\Admin\AppData\Local\Temp\b73e1db94bb8a001b82461238e79b8f1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c .\SDelinves_1.bat
  2⤵
  PID:3648

SDelinves_1.bat

Path C:\Users\Admin\AppData\Local\Temp\SDelinves_1.bat
Size 212B
SHA256 201f4732eda771860168d3b40112333720ba4cfb23d2ed9fd6a77a72e5586f1b
MD5 1a2239944b863aaef21c3df3f369ca03
SHA1 8ba474acd3e362fbfba421167a2661e54abacb7d
SHA512 d97284b94dbd42ebc055b6b127fff09908cf4754e2c58e1dd979bea7ab544320c4371723a0197e0a73724a32ec8416c7d698a3284d6f0f600281853d980ad8cd
MD5 SHA1 SHA512

Submit Download

memory/3952-0-0x0000000002380000-0x0000000002381000-memory.dmp

Download

memory/3952-3-0x0000000000400000-0x00000000005EC000-memory.dmp

Download