d978924e33241ec8823730b37b61e5e709ede32634dbb6b4d9ebb94684413c36

Analysis

max time kernel
91s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 03:39

Target

3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe
Size

28.2MB
MD5

fe94c576b99dcc99b1c82fce00af97ab
SHA1

aea717754ba2ba8fb3981bb87837b150ab659023
SHA256

3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c
SHA512

9bfbc9063924c61a5fe5338ea7c332d764575d62e80ac20356a9d10901b40266dd536d19274302ddf1cdc8b92fdb9c0bda4d807ef012d55db7f5e28453b16b34
SSDEEP

98304:FNE2/fNpo5pemooOoC3iQ5Ao2oPOt6rv8TT5bNGcP/NT41ue+ROhNZkJKfyq1t4C:DE2/CemooOoyz5XPOv5svw1B6

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4988	3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe
4988	3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe
4988	3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe
4988	3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe
976	3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe
976	3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe
976	3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe
976	3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 976	4988	3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe	85
PID 4988 wrote to memory of 976	4988	3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe	85
PID 4988 wrote to memory of 1216	4988	3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe	86
PID 4988 wrote to memory of 1216	4988	3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe	86

C:\Users\Admin\AppData\Local\Temp\3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe
"C:\Users\Admin\AppData\Local\Temp\3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Users\Admin\AppData\Local\Temp\3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe
  C:\Users\Admin\AppData\Local\Temp\3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:976
- C:\Windows\system32\cmd.exe
  cmd.exe /K
  2⤵
  PID:1216