437338edec3968a9d3bf60a87a7ebf162eadb37e201160f2f5569844e54a8010

Analysis

max time kernel
150s
max time network
136s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
29/05/2024, 04:59

Target

Reversed.exe
Size

538KB
MD5

942626c4dc8f6c0a80c48697574bfb87
SHA1

5177f271056f194a38185d2f9bcebbd5cc8444e2
SHA256

437338edec3968a9d3bf60a87a7ebf162eadb37e201160f2f5569844e54a8010
SHA512

b4039d3114a8dc379ad81b933026260e6e23f9ebec1f7bd57955e26e001825fd033f29d5ef8c7f91e607ab03e9a1edb10d359ea4e42ae783ec8fbaaa265553cd
SSDEEP

12288:+Jq9GQUEH+mUhdI2lFmS+Cmd/hkSOPBiBw:+J8tUEemUHrmS/chkhBiB

Score

1^/10

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 2096	4532	Reversed.exe	73
PID 4532 wrote to memory of 2096	4532	Reversed.exe	73
PID 2096 wrote to memory of 3200	2096	cmd.exe	74
PID 2096 wrote to memory of 3200	2096	cmd.exe	74
PID 2096 wrote to memory of 1936	2096	cmd.exe	75
PID 2096 wrote to memory of 1936	2096	cmd.exe	75
PID 2096 wrote to memory of 3588	2096	cmd.exe	76
PID 2096 wrote to memory of 3588	2096	cmd.exe	76
PID 4532 wrote to memory of 4436	4532	Reversed.exe	77
PID 4532 wrote to memory of 4436	4532	Reversed.exe	77
PID 4532 wrote to memory of 1996	4532	Reversed.exe	78
PID 4532 wrote to memory of 1996	4532	Reversed.exe	78

C:\Users\Admin\AppData\Local\Temp\Reversed.exe
"C:\Users\Admin\AppData\Local\Temp\Reversed.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Reversed.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Reversed.exe" MD5
    3⤵
    PID:3200
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:1936
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:3588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1996