33660a9cf07371ef6a0508379ea58cb9d296b61151824900f10a857a54a3a35b

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15/09/2024, 11:37

Target

Frozen_Slotted.exe
Size

723KB
MD5

cea3141ba4fcdc42974724a65bb08e64
SHA1

1e85b24c07a8682c3c14c19ca4277ed010a611b7
SHA256

33660a9cf07371ef6a0508379ea58cb9d296b61151824900f10a857a54a3a35b
SHA512

864be2b86c8b89e3dc2fe099217bc49ebfd56f464bf9babf463790ee4cf6975d4a068e489da69dd4886cb69ffd045c4f68317893ede832b620fe63e0e3226fd7
SSDEEP

12288:w+C8M/+RTnHo6SVAekwkKMZSnrHruUWoX+EDWw6y:rCD+RrHnIcwkKCSn7raoXHa

Score

1^/10

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 3352	2784	Frozen_Slotted.exe	84
PID 2784 wrote to memory of 3352	2784	Frozen_Slotted.exe	84
PID 3352 wrote to memory of 3964	3352	cmd.exe	85
PID 3352 wrote to memory of 3964	3352	cmd.exe	85
PID 3352 wrote to memory of 2776	3352	cmd.exe	86
PID 3352 wrote to memory of 2776	3352	cmd.exe	86
PID 3352 wrote to memory of 4776	3352	cmd.exe	87
PID 3352 wrote to memory of 4776	3352	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\Frozen_Slotted.exe
"C:\Users\Admin\AppData\Local\Temp\Frozen_Slotted.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Frozen_Slotted.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Frozen_Slotted.exe" MD5
    3⤵
    PID:3964
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:2776
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:4776