301caf9b1c6aa0f71638c83bed495e38ac021fe468095ec487271e3cd5284101

Analysis

max time kernel
1792s
max time network
1484s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
23-05-2024 00:17

Target

rrrr/STRESS TEST/LinpackXtreme-1.1.5/LinpackXtreme_x64.exe
Size

112KB
MD5

0f7452fc9575d1cf0ba9a9364bcd3fb8
SHA1

4a3e6e2e87a07bef65b621a455a5448c33518ea9
SHA256

41d9a37f5a4c1ef97b193e6a06427e06053c2d87d1df29fd4a158bd2bcb97ee5
SHA512

3cda5e3950bc18866f46bb6c52ef6df7cbb154bb7f8e981ee2684382558cdd68316fd311cca96c01e37ced7c07e0ee808f6180e5c998437c0ddb0b18e3d7ef84
SSDEEP

1536:jeMPvdUsN7YOxJIzwpRwnwhSidMyMebXtLW:DVT/xJVpanLP3Qt

Score

1^/10

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

LinpackXtreme_x64.execmd.exe

description	pid	process	target process
PID 2588 wrote to memory of 2024	2588	LinpackXtreme_x64.exe	cmd.exe
PID 2588 wrote to memory of 2024	2588	LinpackXtreme_x64.exe	cmd.exe
PID 2024 wrote to memory of 2592	2024	cmd.exe	cmd.exe
PID 2024 wrote to memory of 2592	2024	cmd.exe	cmd.exe
PID 2024 wrote to memory of 3760	2024	cmd.exe	find.exe
PID 2024 wrote to memory of 3760	2024	cmd.exe	find.exe
PID 2024 wrote to memory of 4228	2024	cmd.exe	cmd.exe
PID 2024 wrote to memory of 4228	2024	cmd.exe	cmd.exe
PID 2024 wrote to memory of 1568	2024	cmd.exe	find.exe
PID 2024 wrote to memory of 1568	2024	cmd.exe	find.exe
PID 2024 wrote to memory of 2484	2024	cmd.exe	cmd.exe
PID 2024 wrote to memory of 2484	2024	cmd.exe	cmd.exe
PID 2024 wrote to memory of 8	2024	cmd.exe	find.exe
PID 2024 wrote to memory of 8	2024	cmd.exe	find.exe
PID 2024 wrote to memory of 4192	2024	cmd.exe	cmd.exe
PID 2024 wrote to memory of 4192	2024	cmd.exe	cmd.exe
PID 2024 wrote to memory of 3188	2024	cmd.exe	find.exe
PID 2024 wrote to memory of 3188	2024	cmd.exe	find.exe
PID 2024 wrote to memory of 2328	2024	cmd.exe	cmd.exe
PID 2024 wrote to memory of 2328	2024	cmd.exe	cmd.exe
PID 2024 wrote to memory of 1888	2024	cmd.exe	find.exe
PID 2024 wrote to memory of 1888	2024	cmd.exe	find.exe
PID 2024 wrote to memory of 1232	2024	cmd.exe	choice.exe
PID 2024 wrote to memory of 1232	2024	cmd.exe	choice.exe

C:\Users\Admin\AppData\Local\Temp\rrrr\STRESS TEST\LinpackXtreme-1.1.5\LinpackXtreme_x64.exe
"C:\Users\Admin\AppData\Local\Temp\rrrr\STRESS TEST\LinpackXtreme-1.1.5\LinpackXtreme_x64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2588

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\ACCA.tmp\ACCB.tmp\ACCC.bat "C:\Users\Admin\AppData\Local\Temp\rrrr\STRESS TEST\LinpackXtreme-1.1.5\LinpackXtreme_x64.exe""
2⤵
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo AMD64 Family 6 Model 13 Stepping 2, AuthenticAMD "
3⤵
PID:2592

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo AMD64 Family 6 Model 13 Stepping 2, AuthenticAMD "
3⤵
PID:4228

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo AMD64 Family 6 Model 13 Stepping 2, AuthenticAMD "
3⤵
PID:2484

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo AMD64 Family 6 Model 13 Stepping 2, AuthenticAMD "
3⤵
PID:4192

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo AMD64 Family 6 Model 13 Stepping 2, AuthenticAMD "
3⤵
PID:2328

C:\Windows\system32\choice.exe
choice /c:1234 /n /m "Please select an action to perform: "
3⤵
PID:1232

C:\Users\Admin\AppData\Local\Temp\ACCA.tmp\ACCB.tmp\ACCC.bat
Filesize
8KB

MD5
83502fb0a7965424c9ca96c15e3e182b

SHA1
1ede317060f95ec802306d33f0d43c0325c77a44

SHA256
6b0f30e78b3e7140e9fe8c1da2b5ecd9057c948e45c1ee2a290a7ebe308a5156

SHA512
c800636e8ca32a9b812988ae6d368f8edf6c82f4aacbf91b9d3984682c41a06272c60a24bfdafab838282d52e49cdba29f4befd33ca54fbf58181017d9f06d6d

Download Submit
memory/2588-0-0x0000000140000000-0x0000000140041000-memory.dmp

Filesize
260KB

Download
memory/2588-3-0x0000000140000000-0x0000000140041000-memory.dmp

Filesize
260KB

Download