6a3e1833f43f867e153935467c1a7c1f7f9c2c4b7b4c716a54f959989f091bf2

Resubmissions

16/03/2024, 15:20

16/03/2024, 15:16

max time kernel
53s
max time network
76s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/03/2024, 15:16

Target
Trojan/3PC.exe
Size 229KB
Sample240316-sns9esdf21
SHA256 cb3dd0893f9feda97ab93fff5d607f508c5fbae775b2280a8534c07c0ca4a336
MD5 a5fa59d5da5b595056892a2653e94243
SHA1 f307ae227a656333f8deb99b8e20e2e6dd966b0e
SHA512 a7fd5f28f7ea176333b3144b05306a2d2729e59088bb8ea3e24ba20b5b414a112522fb539b0f6a00a13e3a87874fc4f4968822a718eb3c77b4d53088dd4aea1d
SSDEEP 6144:lBlkZvaF4NTB88S1hJp7OdUoIeYZeOzv4npK:loSWNTW8S5YdUPeVOzQpK
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2728	2480	3PC.exe	29
PID 2480 wrote to memory of 2728	2480	3PC.exe	29
PID 2480 wrote to memory of 2728	2480	3PC.exe	29
PID 2480 wrote to memory of 2728	2480	3PC.exe	29

C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\3266.tmp\3267.tmp\3268.bat C:\Users\Admin\AppData\Local\Temp\Trojan\3PC.exe"
  2⤵
  PID:2728

3268.bat

Path C:\Users\Admin\AppData\Local\Temp\3266.tmp\3267.tmp\3268.bat
Size 597B
SHA256 c0f46b9a7fc82f7007adc96523159ae10571a099eeb0cc00eb930e91424a24a1
MD5 ffa0ad441b308bc1da589f8a734e806f
SHA1 704fc5c8773489b91d2f1ef221ab60ecd3257e3e
SHA512 bfeec821a3b26270e52990799d1c525845203ece47989c161cfa9ecf02675122d8bf1ef8dc3f3db199825d50fd6f4ee54312d8bf4ed827681284e715a6fac55b
MD5 SHA1 SHA512

Submit Download