0423db0f40ac299ff1ab2800f5d9a3500eb68fce6e85f50df53ed51b830a924c

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 17:26

Target

bootstrapper-v2.exe
Size

7.5MB
MD5

c1d60fce98986bc79c36fadd1d5e4870
SHA1

db9581ed6eddc4fdc3f76b51cfef538c78e31730
SHA256

0423db0f40ac299ff1ab2800f5d9a3500eb68fce6e85f50df53ed51b830a924c
SHA512

5a561e3f83785fcf4ca7896cd5b4ad207c3dfcc44449a936df2a91ae19ce44c80b76d85920ec78004843a913ec1efd685edffe33ab8168391c9babe1da2e8ae0
SSDEEP

98304:b/QbKFqb0xArjeLY9Mkm0DShKdXcIQ/inad9oU0xWLwQ5f7uR:MbKEb0xAriLYCkm0DShKZcccChkdtuR

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 2268	4792	bootstrapper-v2.exe	85
PID 4792 wrote to memory of 2268	4792	bootstrapper-v2.exe	85

C:\Users\Admin\AppData\Local\Temp\bootstrapper-v2.exe
"C:\Users\Admin\AppData\Local\Temp\bootstrapper-v2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\system32\cmd.exe
  cmd /C ver
  2⤵
  PID:2268