7fcfbf479e1b46e9187ac70a2d9a236e156c84cc0bf05f83b38741758e82e08d

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09-06-2024 04:41

Target

VISPLOIT.exe
Size

199KB
MD5

e00a60834438fc5d940888b913121c3b
SHA1

e52940fd8ce5c390af4f87b0f54b7cfe9a126798
SHA256

7fcfbf479e1b46e9187ac70a2d9a236e156c84cc0bf05f83b38741758e82e08d
SHA512

6e491da4c6d999a8393f1e87962997882cc0141ac555d501990810e3409d1494225553cbe7a7afc610e1c3ccbb50f7032f4126562d15df3daafb7ab2a7098cd7
SSDEEP

1536:OtFL3fvwu9SkZKJH2zQy4WblNeG1ath5NZQK3eWj/NQhTXH:Oj3fvwu9SkQH2ZfbOx5Nmclkj

Score

1^/10

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 1680	1276	VISPLOIT.exe	29
PID 1276 wrote to memory of 1680	1276	VISPLOIT.exe	29
PID 1276 wrote to memory of 1680	1276	VISPLOIT.exe	29
PID 1680 wrote to memory of 1728	1680	cmd.exe	30
PID 1680 wrote to memory of 1728	1680	cmd.exe	30
PID 1680 wrote to memory of 1728	1680	cmd.exe	30
PID 1276 wrote to memory of 2160	1276	VISPLOIT.exe	31
PID 1276 wrote to memory of 2160	1276	VISPLOIT.exe	31
PID 1276 wrote to memory of 2160	1276	VISPLOIT.exe	31
PID 2160 wrote to memory of 2988	2160	cmd.exe	32
PID 2160 wrote to memory of 2988	2160	cmd.exe	32
PID 2160 wrote to memory of 2988	2160	cmd.exe	32
PID 1276 wrote to memory of 2052	1276	VISPLOIT.exe	33
PID 1276 wrote to memory of 2052	1276	VISPLOIT.exe	33
PID 1276 wrote to memory of 2052	1276	VISPLOIT.exe	33

C:\Users\Admin\AppData\Local\Temp\VISPLOIT.exe
"C:\Users\Admin\AppData\Local\Temp\VISPLOIT.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mode con cols=85
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Windows\system32\mode.com
    mode con cols=85
    3⤵
    PID:1728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mode con lines=25
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\system32\mode.com
    mode con lines=25
    3⤵
    PID:2988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c TITLE Visploit
  2⤵
  PID:2052