d978924e33241ec8823730b37b61e5e709ede32634dbb6b4d9ebb94684413c36

Analysis

max time kernel
91s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06-07-2024 03:39

Target

3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe
Size

28.2MB
MD5

fe94c576b99dcc99b1c82fce00af97ab
SHA1

aea717754ba2ba8fb3981bb87837b150ab659023
SHA256

3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c
SHA512

9bfbc9063924c61a5fe5338ea7c332d764575d62e80ac20356a9d10901b40266dd536d19274302ddf1cdc8b92fdb9c0bda4d807ef012d55db7f5e28453b16b34
SSDEEP

98304:FNE2/fNpo5pemooOoC3iQ5Ao2oPOt6rv8TT5bNGcP/NT41ue+ROhNZkJKfyq1t4C:DE2/CemooOoyz5XPOv5svw1B6

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe

pid	process
4988	3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe
4988	3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe
4988	3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe
4988	3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe
976	3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe
976	3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe
976	3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe
976	3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe

description	pid	process	target process
PID 4988 wrote to memory of 976	4988	3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe	3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe
PID 4988 wrote to memory of 976	4988	3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe	3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe
PID 4988 wrote to memory of 1216	4988	3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe	cmd.exe
PID 4988 wrote to memory of 1216	4988	3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe
C:\Users\Admin\AppData\Local\Temp\3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:976