24af715cb601628c408725a6b17538d2c3128a01ebdb74fc73d5e35b7f39e7be

Analysis

max time kernel
300s
max time network
278s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
08/06/2024, 20:30

Target

BE forcer.exe
Size

627KB
MD5

4548a4dfc9a9a11826a0f1f7185cb4a3
SHA1

b116704be0ed1f81b328becbf61f207056a0294f
SHA256

24af715cb601628c408725a6b17538d2c3128a01ebdb74fc73d5e35b7f39e7be
SHA512

dc57036a6bd0d03c81ebf01f87e28b9fdcc949b6f82ed7a7f73514d2f540ac62ed7d631ede0767e53f8193577207252b5b177fbf0e255de1bb5cf941d5cd0709
SSDEEP

12288:yrwImNhpkHXXSNAE8xT73pAke1Fqjl7p6KtfP88D:MmNhO3XSSEMxAkYFqpdXs8

Score

1^/10

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3580 wrote to memory of 3584	3580	BE forcer.exe	79
PID 3580 wrote to memory of 3584	3580	BE forcer.exe	79
PID 3584 wrote to memory of 3032	3584	cmd.exe	80
PID 3584 wrote to memory of 3032	3584	cmd.exe	80
PID 3584 wrote to memory of 3092	3584	cmd.exe	81
PID 3584 wrote to memory of 3092	3584	cmd.exe	81
PID 3584 wrote to memory of 4244	3584	cmd.exe	82
PID 3584 wrote to memory of 4244	3584	cmd.exe	82

C:\Users\Admin\AppData\Local\Temp\BE forcer.exe
"C:\Users\Admin\AppData\Local\Temp\BE forcer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\BE forcer.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3584
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\BE forcer.exe" MD5
    3⤵
    PID:3032
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:3092
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:4244