29baa408662e7783695fb007d84f3b192daed4fca403215ddc4edeaaa14dbcc4

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 17:25

Target

Goblin.exe
Size

704KB
MD5

a0eecf9df2066fee2a579a4722cb0aba
SHA1

8955ef7bc4bfebd994ec4aaba4fc2d4ae4cdd8aa
SHA256

ca976293e8f616b417dbaaf62831cfb8ea41b0ba25ef652c1696b164231e8b0b
SHA512

4ba533085798a01966efbcb8f158d01526ac1da75bd0c41facbc889c97cf9d819fd6e09100689d8fbceb9073f5af8e2a423e45a563f9ca36aace79a5b8c34275
SSDEEP

12288:TuWtlv0SfIHNjodPGcfjsP1L28DZbM0SeYe738+BC8:TugV0+IFo17sP1L9VbIfe73pC8

Score

1^/10

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2304	2944	Goblin.exe	29
PID 2944 wrote to memory of 2304	2944	Goblin.exe	29
PID 2944 wrote to memory of 2304	2944	Goblin.exe	29
PID 2304 wrote to memory of 2600	2304	cmd.exe	30
PID 2304 wrote to memory of 2600	2304	cmd.exe	30
PID 2304 wrote to memory of 2600	2304	cmd.exe	30
PID 2304 wrote to memory of 2340	2304	cmd.exe	31
PID 2304 wrote to memory of 2340	2304	cmd.exe	31
PID 2304 wrote to memory of 2340	2304	cmd.exe	31
PID 2304 wrote to memory of 2632	2304	cmd.exe	32
PID 2304 wrote to memory of 2632	2304	cmd.exe	32
PID 2304 wrote to memory of 2632	2304	cmd.exe	32
PID 2944 wrote to memory of 2624	2944	Goblin.exe	33
PID 2944 wrote to memory of 2624	2944	Goblin.exe	33
PID 2944 wrote to memory of 2624	2944	Goblin.exe	33

C:\Users\Admin\AppData\Local\Temp\Goblin.exe
"C:\Users\Admin\AppData\Local\Temp\Goblin.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Goblin.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Goblin.exe" MD5
    3⤵
    PID:2600
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:2340
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:2632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2624