20ce81699b21afc44d90d67940cd954e68984bf7734806ac1876d55a61a84aad

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 10:28

Target

ware.exe
Size

668KB
MD5

b060c81112b43fa45639dd2d6f57da40
SHA1

82fc7df8a552b07c91dffb4811f0267ee09176d7
SHA256

20ce81699b21afc44d90d67940cd954e68984bf7734806ac1876d55a61a84aad
SHA512

963d105ae74240e15b7f0359e10d4d160ca60d736268381db80120879d9e9016964bba3ddbeb16a9af0bd13aab3067f96eccd7b645569d905609dfb40720526e
SSDEEP

12288:+8v71X8+RQTkx7DIUlayluASvHkhKnlldKjZ6lWD:+818+RQgxHIuuAmH1lXy6l

Score

1^/10

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1744	2028	ware.exe	29
PID 2028 wrote to memory of 1744	2028	ware.exe	29
PID 2028 wrote to memory of 1744	2028	ware.exe	29
PID 1744 wrote to memory of 2052	1744	cmd.exe	30
PID 1744 wrote to memory of 2052	1744	cmd.exe	30
PID 1744 wrote to memory of 2052	1744	cmd.exe	30
PID 1744 wrote to memory of 2736	1744	cmd.exe	31
PID 1744 wrote to memory of 2736	1744	cmd.exe	31
PID 1744 wrote to memory of 2736	1744	cmd.exe	31
PID 1744 wrote to memory of 2944	1744	cmd.exe	32
PID 1744 wrote to memory of 2944	1744	cmd.exe	32
PID 1744 wrote to memory of 2944	1744	cmd.exe	32
PID 2028 wrote to memory of 2700	2028	ware.exe	33
PID 2028 wrote to memory of 2700	2028	ware.exe	33
PID 2028 wrote to memory of 2700	2028	ware.exe	33

C:\Users\Admin\AppData\Local\Temp\ware.exe
"C:\Users\Admin\AppData\Local\Temp\ware.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\ware.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\ware.exe" MD5
    3⤵
    PID:2052
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:2736
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:2944
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2028 -s 1536
  2⤵
  PID:2700