99ba7acf4940af4bc26785e02b7e87a9808469946941905a3988c958a04819b7

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 03:22

Target

99ba7acf4940af4bc26785e02b7e87a9808469946941905a3988c958a04819b7.exe
Size

260KB
MD5

daa8967f205cdd338cdf68f48c8fa200
SHA1

b3daaf9dc708737bb27f39102af3c542b752596c
SHA256

99ba7acf4940af4bc26785e02b7e87a9808469946941905a3988c958a04819b7
SHA512

99ea2cfe01e11134eace2149ae6b316b78d411827541b5c74ba0bd0e8b5a9e04510e8f215821797c2e804eb4258da8c7c774360c69ed4bf9a4d564a00c926f88
SSDEEP

6144:JGOzEFMSbUwzaAL50wB1V1vb91GngN+V00slxZohwKD:JGgEFMStblfD7jo

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 4920	1616	99ba7acf4940af4bc26785e02b7e87a9808469946941905a3988c958a04819b7.exe	82
PID 1616 wrote to memory of 4920	1616	99ba7acf4940af4bc26785e02b7e87a9808469946941905a3988c958a04819b7.exe	82

C:\Users\Admin\AppData\Local\Temp\99ba7acf4940af4bc26785e02b7e87a9808469946941905a3988c958a04819b7.exe
"C:\Users\Admin\AppData\Local\Temp\99ba7acf4940af4bc26785e02b7e87a9808469946941905a3988c958a04819b7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:4920