b75ff60aaccd7c025a5a2d27afc266bf23808cf46840a4bc868859f0902e09a8

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 15:27

Target

喜欢此软件_love it.exe
Size

66KB
MD5

d4d4be4bd56ed03eca031be8b8a9814c
SHA1

06d4aef8a831a883c5574d4b46c29df4b81992bf
SHA256

c90d9af17233a717fdb8b08d45749680efeca7046deef950ff1d4e987be68681
SHA512

75d5a6df561b4bbd497a45bb7feb4f11dce2b28eff93ec8ffe5cae0cdde0857f5346aa498bd908307f81c1f15cac088cdc1ba96434ef4a2d135bcf45063f96cf
SSDEEP

1536:JdBoWdHaDL1UOUc01anifKUYJFqLa4qpqR:JgWdHaDhocDGKU4t4qpqR

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 2216	1188	喜欢此软件_love it.exe	28
PID 1188 wrote to memory of 2216	1188	喜欢此软件_love it.exe	28
PID 1188 wrote to memory of 2216	1188	喜欢此软件_love it.exe	28
PID 1188 wrote to memory of 2216	1188	喜欢此软件_love it.exe	28

C:\Users\Admin\AppData\Local\Temp\喜欢此软件_love it.exe
"C:\Users\Admin\AppData\Local\Temp\喜欢此软件_love it.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bt07027.bat "C:\Users\Admin\AppData\Local\Temp\?????_love it.exe"
  2⤵
  PID:2216

C:\Users\Admin\AppData\Local\Temp\bt07027.bat

Filesize
225B

MD5
8b199a7b5885fc7be127f0fdba39140e

SHA1
0b3015371825ed1d02ceb79c7f5a4ee719ebe7a3

SHA256
7f9ffd0b55164fb619f9fc314726047df7620a7368b95fa7cc460ad3c0be135f

SHA512
430f2d098de2182aa4e592aa9d07e1c414468c4cfd9bac6ebc181596ff9f7a8a5f364e51428d8bab043d40633a804e12f880afbdbece7cb5779ed3f493fe924f

Download Submit
memory/1188-5-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download