58691af22fbd8b84e66bd2d90b606ca66255319bf6077887fa784b83587c8ae3

Analysis

max time kernel
150s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 01:59

Target

u237cgatAh2.exe
Size

5.6MB
MD5

0e2c1ee8e6bdb339094ec24026a01e20
SHA1

449972cb63e21bf25d03ad1e85cf87af97c75a2e
SHA256

ffe104f44b6a84074e2305fba55c1cb777446d1dace44c23eaf873536dcc542f
SHA512

c0a71a9d796802bdf7110c8f69ebdaeb9c968df69b41a8bc1ff52f3a4082f40df93085ec278863acc93763ca11114b4eac5278db136540be0bea67aa93c607c5
SSDEEP

98304:6s2vdJmvMwJ2liHiHeCJ+46C2m0B/YMh6FuLChc4n5Gc6jLq:6pdJK/46iHu4525Vh6FuLChRn5l6j2

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

u237cgatAh2.exe

pid process

1136 u237cgatAh2.exe
1136 u237cgatAh2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

u237cgatAh2.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

u237cgatAh2.execmd.exe

description	pid	process	target process
PID 1136 wrote to memory of 2336	1136	u237cgatAh2.exe	cmd.exe
PID 1136 wrote to memory of 2336	1136	u237cgatAh2.exe	cmd.exe
PID 2336 wrote to memory of 5088	2336	cmd.exe	certutil.exe
PID 2336 wrote to memory of 5088	2336	cmd.exe	certutil.exe
PID 2336 wrote to memory of 4144	2336	cmd.exe	find.exe
PID 2336 wrote to memory of 4144	2336	cmd.exe	find.exe
PID 2336 wrote to memory of 3144	2336	cmd.exe	find.exe
PID 2336 wrote to memory of 3144	2336	cmd.exe	find.exe
PID 1136 wrote to memory of 2852	1136	u237cgatAh2.exe	cmd.exe
PID 1136 wrote to memory of 2852	1136	u237cgatAh2.exe	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\u237cgatAh2.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
2⤵
- Suspicious use of WriteProcessMemory
PID:2336

C:\Windows\system32\certutil.exe
certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\u237cgatAh2.exe" MD5
3⤵
PID:5088

memory/1136-5-0x00007FF667A00000-0x00007FF6683D8000-memory.dmp

Filesize
9.8MB

Download
memory/1136-0-0x00007FF85C670000-0x00007FF85C672000-memory.dmp

Filesize
8KB

Download
memory/1136-1-0x00007FF667A00000-0x00007FF6683D8000-memory.dmp

Filesize
9.8MB

Download
memory/1136-6-0x00007FF667A00000-0x00007FF6683D8000-memory.dmp

Filesize
9.8MB

Download
memory/1136-7-0x00007FF667A00000-0x00007FF6683D8000-memory.dmp

Filesize
9.8MB

Download