40e509395b0e3ef6949f5f822f0fcb468120b53e761787cec0eb97d8770e5e46

Analysis

max time kernel
95s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 14:51

Target
Trololo.exe
Size 724KB
Sample240603-r757nabc65
SHA256 40e509395b0e3ef6949f5f822f0fcb468120b53e761787cec0eb97d8770e5e46
MD5 1bcda0323861d65f1ca9d33a2db30fe9
SHA1 448b516635f52a6feb3ddce05c1a8ee844355f3d
SHA512 c951d5367804910979bc1fb6e79a2faeb2cc7b6775e60b75f9eef1929f8c33f6ecf226b9522204a194f71ce22988481f4aa5481619971ea375d3de9ea857240d
SSDEEP 12288:0oSWNTVY58qOQt5Sbyqh2Ns2impt0j+m/EB+dayjNxEzy9g6Vzfdk49Z7UKnj:0oS2TVY+eYuUmL0jlEBSicguJFoCj
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 4404	4104	Trololo.exe	82
PID 4104 wrote to memory of 4404	4104	Trololo.exe	82
PID 4404 wrote to memory of 1924	4404	cmd.exe	83
PID 4404 wrote to memory of 1924	4404	cmd.exe	83

C:\Users\Admin\AppData\Local\Temp\Trololo.exe
"C:\Users\Admin\AppData\Local\Temp\Trololo.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\36BF.tmp\36C0.tmp\36C1.bat C:\Users\Admin\AppData\Local\Temp\Trololo.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4404
- - C:\Windows\system32\mode.com
    mode con: cols=75 lines=9
    3⤵
    PID:1924

36C1.bat

Path C:\Users\Admin\AppData\Local\Temp\36BF.tmp\36C0.tmp\36C1.bat
Size 635KB
SHA256 75006a3289ade6f4908dd237d90d2fb0a293e7ddb46659b34d3efe5c6a4da33b
MD5 fd8fb47fcd96c8384b09ffa9ddf1a4bf
SHA1 f0bd70720f06e9d9460a9962dbec6a65afb3620c
SHA512 68ee885e1798dc29bb2047809cc54e437b76a2327274b8a9fa3df2c5e04df93f79ec2cee6ca9a62df3b884ecdf9f3df8f707e78b73021c02df8e0ca0158449d1
SSDEEP 12288:CyhGA2Da1ccgLH7XQNaQeRmWhg3q+rxN3nG01/3eu2KWy:CS2xjDjUVx3eHhy
MD5 SHA1 SHA512 SSDEEP

Submit Download