cfc4b5fed54168c830c5d82cd4832ffbc92b4b83e5000c612bba9a36deb13849

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 19:36

Target

cfc4b5fed54168c830c5d82cd4832ffbc92b4b83e5000c612bba9a36deb13849.exe
Size

9KB
MD5

db76d51ce2237b8b9e0094f34b575420
SHA1

c8f4d7bb5051d46869f10b05627cd94283cdfb5b
SHA256

cfc4b5fed54168c830c5d82cd4832ffbc92b4b83e5000c612bba9a36deb13849
SHA512

3d524181016d2633922a8924786ca08f206411dbebd9027297aa83c2db8e36d70a3b4e32e8e83544ad1426fd4084b56e3eb84f35248f1022c6310ac945f32bde
SSDEEP

192:aFCjDsjbWWJr/jOe00HmU3kXV7E5pz6fMQG:iqD4TJbj60HmUU7P

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 5036	3692	cfc4b5fed54168c830c5d82cd4832ffbc92b4b83e5000c612bba9a36deb13849.exe	85
PID 3692 wrote to memory of 5036	3692	cfc4b5fed54168c830c5d82cd4832ffbc92b4b83e5000c612bba9a36deb13849.exe	85
PID 3692 wrote to memory of 5036	3692	cfc4b5fed54168c830c5d82cd4832ffbc92b4b83e5000c612bba9a36deb13849.exe	85

C:\Users\Admin\AppData\Local\Temp\cfc4b5fed54168c830c5d82cd4832ffbc92b4b83e5000c612bba9a36deb13849.exe
"C:\Users\Admin\AppData\Local\Temp\cfc4b5fed54168c830c5d82cd4832ffbc92b4b83e5000c612bba9a36deb13849.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:5036