3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c

Analysis

max time kernel
145s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
04-07-2024 16:21

Target

3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe
Size

28.2MB
MD5

fe94c576b99dcc99b1c82fce00af97ab
SHA1

aea717754ba2ba8fb3981bb87837b150ab659023
SHA256

3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c
SHA512

9bfbc9063924c61a5fe5338ea7c332d764575d62e80ac20356a9d10901b40266dd536d19274302ddf1cdc8b92fdb9c0bda4d807ef012d55db7f5e28453b16b34
SSDEEP

98304:FNE2/fNpo5pemooOoC3iQ5Ao2oPOt6rv8TT5bNGcP/NT41ue+ROhNZkJKfyq1t4C:DE2/CemooOoyz5XPOv5svw1B6

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe

pid	process
1216	3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe
1216	3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe
1216	3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe
1216	3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe
4152	3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe
4152	3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe
4152	3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe
4152	3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe

description	pid	process	target process
PID 1216 wrote to memory of 4152	1216	3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe	3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe
PID 1216 wrote to memory of 4152	1216	3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe	3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe
PID 1216 wrote to memory of 3736	1216	3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe	cmd.exe
PID 1216 wrote to memory of 3736	1216	3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe
C:\Users\Admin\AppData\Local\Temp\3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4152