71319a67df80230e1b2c80b0d38a385f165db1688e17ac6e7897d330bc55461a

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 11:45

Target

agas.exe
Size

678KB
MD5

6f222b7903bb6198d413030befe12940
SHA1

04164a4058132fac9e144df3128ab3f660cb4245
SHA256

71319a67df80230e1b2c80b0d38a385f165db1688e17ac6e7897d330bc55461a
SHA512

025f119715f73ae3be765db15e942a9811e260949598e813e5f4bd71506588d15eb206aa0890cfab4d6f643e039dc220f21eba27864797cfc07b12ce2a6acdd2
SSDEEP

12288:orrEBo7lhHfN6zQO8h6GQnQqzdL4qjjIY5ewA:oXz7lhl6kv0nQqzBJj8dwA

Score

1^/10

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 404	532	agas.exe	84
PID 532 wrote to memory of 404	532	agas.exe	84
PID 404 wrote to memory of 4388	404	cmd.exe	85
PID 404 wrote to memory of 4388	404	cmd.exe	85
PID 404 wrote to memory of 3356	404	cmd.exe	86
PID 404 wrote to memory of 3356	404	cmd.exe	86
PID 404 wrote to memory of 1868	404	cmd.exe	87
PID 404 wrote to memory of 1868	404	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\agas.exe
"C:\Users\Admin\AppData\Local\Temp\agas.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\agas.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:404
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\agas.exe" MD5
    3⤵
    PID:4388
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:3356
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:1868