4eaeeda72c1352264f13d2ceea4d43306d5f175f0d3c37979f9fb0fd60c553ee

Analysis

max time kernel
451s
max time network
1174s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
12/05/2024, 07:57

Target
petya_key.exe
Size 76KB
Sample240512-jtkd2aag78
SHA256 368dff8cfb0f54941d5ebcdc41148f01d14137f8c7aade1a3c94824ecb9535ac
MD5 7d301ba376944a3e2ca31d4364a5a876
SHA1 7c1b6dbe3de9c6495ee9524db78524b035996f69
SHA512 274241590919749bc739c4b101b05c0c0d5becd058cbf8350afffcf2369a5eefc4078ac144e3ed8b6676a710cd53b17496d29b729ae7235bef27dbf8f6cadc54
SSDEEP 768:5gQU49CEBHSNrpqOQ5JHQZurQ6MAPxLBdzMd3xTrdDbYJcE4+zTmyQCzg28zlhqx:O9WBxQZ5sxFGN+sP/+SrU/ljcGwPc
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 1344	2168	petya_key.exe	80
PID 2168 wrote to memory of 1344	2168	petya_key.exe	80
PID 2168 wrote to memory of 1344	2168	petya_key.exe	80

C:\Users\Admin\AppData\Local\Temp\petya_key.exe
"C:\Users\Admin\AppData\Local\Temp\petya_key.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:1344