6a3e1833f43f867e153935467c1a7c1f7f9c2c4b7b4c716a54f959989f091bf2

Resubmissions

16/03/2024, 15:20

16/03/2024, 15:16

max time kernel
58s
max time network
72s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/03/2024, 15:16

Target
Trojan/+.exe
Size 215KB
Sample240316-sns9esdf21
SHA256 59d911f4a0361bf996f58008f49f98112ae4539cd58072bdfba98f0c06e4b281
MD5 bb9680f552ef1dc2d05213f02e10581d
SHA1 deac698089fdcd005fa557a3f1fd72fbc05c7e3f
SHA512 28e366b26a7d48802d23d5caefba58035caa7afce2f1b3adcf371338d301f9dcfc5cfa53dd79e5ecdee4ca12a62c6fa8e0855ba560a1a23f858c04b854461001
SSDEEP 6144:ktzsb5Uh28+V1WW69B9VjMdxPedN9ug0z9TB9ShTDBFuu35:ktzE5elwLz9TrWPS45
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2716	2480	+.exe	30
PID 2480 wrote to memory of 2716	2480	+.exe	30
PID 2480 wrote to memory of 2716	2480	+.exe	30

C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\1FEF.tmp\1FF0.tmp\1FF1.bat C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe"
  2⤵
  PID:2716

1FF1.bat

Path C:\Users\Admin\AppData\Local\Temp\1FEF.tmp\1FF0.tmp\1FF1.bat
Size 360B
SHA256 f66989c140003a23e046dc0fd1f14d3ffee42e55b86c6f406c23406090005fbc
MD5 cffeffdd19a93f72fce9ae0b27fc7d41
SHA1 d51f874d7e1dbce87a6615db19e3bb3cd7918050
SHA512 197241112fd18486acbddeee1211ed801bbc1fb061b1a4a4917f67b7855c015d6ebf60ae16226733ecccd95d8ecd95c65c9eb49dbf1a9443076c4193380ac26b
MD5 SHA1 SHA512

Submit Download