5d8159897acac6a7349dad41208004e071e0ad0388142d81bb4cc72ef459a500

Analysis

max time kernel
6s
max time network
9s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 19:29

Target

VIZSPLOIT.exe
Size

194KB
MD5

1f29ee3673fc717fcb8f6007c3f840cd
SHA1

5efd71aa728a1699a890e7acbff5f38402b56b4e
SHA256

5d8159897acac6a7349dad41208004e071e0ad0388142d81bb4cc72ef459a500
SHA512

c1b79a9edfbf8ef9536c28131a9a800cc911ccfb4a7504675566ce9e9bde69965fa4c7e04902f206dfa63c1bb58071809939c8ca3f8ae5adca79ee7d59cab4c3
SSDEEP

1536:1vpAmWd3xjj3KI9j8h0EXdleYz8KCKxBoQ4c8:1BAmWd39tju1tleVKCKxLD8

Score

1^/10

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 632	4856	VIZSPLOIT.exe	82
PID 4856 wrote to memory of 632	4856	VIZSPLOIT.exe	82
PID 632 wrote to memory of 3096	632	cmd.exe	83
PID 632 wrote to memory of 3096	632	cmd.exe	83
PID 4856 wrote to memory of 4412	4856	VIZSPLOIT.exe	84
PID 4856 wrote to memory of 4412	4856	VIZSPLOIT.exe	84
PID 4412 wrote to memory of 3880	4412	cmd.exe	85
PID 4412 wrote to memory of 3880	4412	cmd.exe	85
PID 4856 wrote to memory of 3120	4856	VIZSPLOIT.exe	86
PID 4856 wrote to memory of 3120	4856	VIZSPLOIT.exe	86

C:\Users\Admin\AppData\Local\Temp\VIZSPLOIT.exe
"C:\Users\Admin\AppData\Local\Temp\VIZSPLOIT.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mode con cols=85
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:632
- - C:\Windows\system32\mode.com
    mode con cols=85
    3⤵
    PID:3096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mode con lines=25
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\Windows\system32\mode.com
    mode con lines=25
    3⤵
    PID:3880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c TITLE Visploit
  2⤵
  PID:3120