64af147c68a1e9ab272322962e043b51657da005a827980df1619e0f1e6ec35f

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 18:54

Target
Trojan/+.exe
Size 215KB
Sample240620-xj87asseqa
SHA256 59d911f4a0361bf996f58008f49f98112ae4539cd58072bdfba98f0c06e4b281
MD5 bb9680f552ef1dc2d05213f02e10581d
SHA1 deac698089fdcd005fa557a3f1fd72fbc05c7e3f
SHA512 28e366b26a7d48802d23d5caefba58035caa7afce2f1b3adcf371338d301f9dcfc5cfa53dd79e5ecdee4ca12a62c6fa8e0855ba560a1a23f858c04b854461001
SSDEEP 6144:ktzsb5Uh28+V1WW69B9VjMdxPedN9ug0z9TB9ShTDBFuu35:ktzE5elwLz9TrWPS45
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 1348	2804	+.exe	84
PID 2804 wrote to memory of 1348	2804	+.exe	84

C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\5A93.tmp\5A94.tmp\5A95.bat C:\Users\Admin\AppData\Local\Temp\Trojan\+.exe"
  2⤵
  PID:1348

5A95.bat

Path C:\Users\Admin\AppData\Local\Temp\5A93.tmp\5A94.tmp\5A95.bat
Size 360B
SHA256 f66989c140003a23e046dc0fd1f14d3ffee42e55b86c6f406c23406090005fbc
MD5 cffeffdd19a93f72fce9ae0b27fc7d41
SHA1 d51f874d7e1dbce87a6615db19e3bb3cd7918050
SHA512 197241112fd18486acbddeee1211ed801bbc1fb061b1a4a4917f67b7855c015d6ebf60ae16226733ecccd95d8ecd95c65c9eb49dbf1a9443076c4193380ac26b
MD5 SHA1 SHA512

Submit Download