3bb28d46c9a0d8f1890c98f5703a2d4bb39c44ade335d89cc1eb7d82465c05a9

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 02:23

Target
c4bb9daa61d72d942a02895b41a36843.exe
Size 56KB
Sample240313-cvmr8aac4v
SHA256 3bb28d46c9a0d8f1890c98f5703a2d4bb39c44ade335d89cc1eb7d82465c05a9
MD5 c4bb9daa61d72d942a02895b41a36843
SHA1 d7674b1cc6c544e5bdf516d6ed7a50c0e0ce2268
SHA512 d911765c6c20c544f264c33035193bf571649f26a6ccd0ff89a82623c52d7da79964db5d56c08a708ac13f98d4256bf5128e6548a56f3e29691536ee1ee6dd54
SSDEEP 1536:3TnI6XWZJC897GFmlT053rzw3r7X6Io9Ohe2TQKfEV4o:3TITm8BGFYT0Jeb6IoUPQgg
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2140	2652	c4bb9daa61d72d942a02895b41a36843.exe	89
PID 2652 wrote to memory of 2140	2652	c4bb9daa61d72d942a02895b41a36843.exe	89
PID 2652 wrote to memory of 2140	2652	c4bb9daa61d72d942a02895b41a36843.exe	89

C:\Users\Admin\AppData\Local\Temp\c4bb9daa61d72d942a02895b41a36843.exe
"C:\Users\Admin\AppData\Local\Temp\c4bb9daa61d72d942a02895b41a36843.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\dmedme.bat
  2⤵
  PID:2140

dmedme.bat

Path C:\Users\Admin\AppData\Local\Temp\dmedme.bat
Size 184B
SHA256 bf75e37ec383ed6384b580e1a3826d5a542c737496e857f62f009b1e9b04b205
MD5 5a0b190b7a8f430368e94db32a035b76
SHA1 c93fcdc163ec48a552b94034197e366bf7c013a4
SHA512 4e800495db7fbba008eef070528d59a1fe34055bb7492faee313c9f9c5c8e860dd7bc194ee8ac9b9f031d27a80aa72dbc3bce8c323a84c2a6b40e9734a2d86c5
MD5 SHA1 SHA512

Submit Download

memory/2652-2-0x0000000000400000-0x0000000000426000-memory.dmp

Download