24af715cb601628c408725a6b17538d2c3128a01ebdb74fc73d5e35b7f39e7be

Analysis

max time kernel
94s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 13:14

Target

BE forcer.exe
Size

627KB
MD5

4548a4dfc9a9a11826a0f1f7185cb4a3
SHA1

b116704be0ed1f81b328becbf61f207056a0294f
SHA256

24af715cb601628c408725a6b17538d2c3128a01ebdb74fc73d5e35b7f39e7be
SHA512

dc57036a6bd0d03c81ebf01f87e28b9fdcc949b6f82ed7a7f73514d2f540ac62ed7d631ede0767e53f8193577207252b5b177fbf0e255de1bb5cf941d5cd0709
SSDEEP

12288:yrwImNhpkHXXSNAE8xT73pAke1Fqjl7p6KtfP88D:MmNhO3XSSEMxAkYFqpdXs8

Score

1^/10

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 2828	772	BE forcer.exe	82
PID 772 wrote to memory of 2828	772	BE forcer.exe	82
PID 2828 wrote to memory of 4156	2828	cmd.exe	83
PID 2828 wrote to memory of 4156	2828	cmd.exe	83
PID 2828 wrote to memory of 4840	2828	cmd.exe	84
PID 2828 wrote to memory of 4840	2828	cmd.exe	84
PID 2828 wrote to memory of 1572	2828	cmd.exe	85
PID 2828 wrote to memory of 1572	2828	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\BE forcer.exe
"C:\Users\Admin\AppData\Local\Temp\BE forcer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\BE forcer.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\BE forcer.exe" MD5
    3⤵
    PID:4156
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:4840
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:1572