a6bf1b3e88fe62ba65250466c18b6d6ce371df25c75d50aaec5619281f7f53e1

Analysis

max time kernel
1469s
max time network
1482s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
17/08/2024, 10:57

Target

build patch.exe
Size

1.4MB
MD5

12e377b3790dfe601181b1d20f47c3e3
SHA1

ea56f83370eea618df26837524454bf8487c9976
SHA256

86e0c4a3ad1c88d1bc22efa39311b80de428291d40f89a43cfc199a563b9be3f
SHA512

f6f3deb097a751341937f1f944e74a84c3b96aca7892ade01e50da854fc5d5ad3727f4c1ea4dbf1c881ab9a7007f6fcd51c7a5d87fa11a965367371613ca3107
SSDEEP

24576:wzJnIwl1Hsf2BZ9JnMKKQZiXDeOPaW4C30Wemex2ze+9SpPLn7J0:wNdsf2dJnMQ0mPe

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 3564	4004	build patch.exe	82
PID 4004 wrote to memory of 3564	4004	build patch.exe	82
PID 4004 wrote to memory of 4844	4004	build patch.exe	84
PID 4004 wrote to memory of 4844	4004	build patch.exe	84
PID 4844 wrote to memory of 3904	4844	cmd.exe	85
PID 4844 wrote to memory of 3904	4844	cmd.exe	85
PID 4844 wrote to memory of 3412	4844	cmd.exe	86
PID 4844 wrote to memory of 3412	4844	cmd.exe	86
PID 4844 wrote to memory of 3132	4844	cmd.exe	87
PID 4844 wrote to memory of 3132	4844	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\build patch.exe
"C:\Users\Admin\AppData\Local\Temp\build patch.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color f
  2⤵
  PID:3564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\build patch.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\build patch.exe" MD5
    3⤵
    PID:3904
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:3412
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:3132