165356f1cdd243a49c95d3df02069391e079b8ef40302bb887cc146818fa84a4

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 21:38

Target

necrumBypas3s (1).exe
Size

3.7MB
MD5

06d9c1f5142610b929557ea6e6005a63
SHA1

13fa5f3a7daa5a9a43922a6bf4f5bf4884b811ee
SHA256

165356f1cdd243a49c95d3df02069391e079b8ef40302bb887cc146818fa84a4
SHA512

eeeb91c705b17474836dacb3d3b9f5accfda8d027c1091332ff11b8de32038d184589fe5493cf38e4a47f1662ca17aeffcef2d3dedda69f8f7df6756c903e4e8
SSDEEP

49152:c4/6eXhp59mEp7nUX7IU6ivGtlqaVwASOrfmrTEbTRjkek2FjufBaCOh5PaOcegJ:c4/6Ep+Y39mHqWN2K4E+gPdo

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3552	necrumBypas3s (1).exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 3748	3552	necrumBypas3s (1).exe	83
PID 3552 wrote to memory of 3748	3552	necrumBypas3s (1).exe	83
PID 3748 wrote to memory of 1144	3748	cmd.exe	85
PID 3748 wrote to memory of 1144	3748	cmd.exe	85
PID 3748 wrote to memory of 1936	3748	cmd.exe	86
PID 3748 wrote to memory of 1936	3748	cmd.exe	86
PID 3748 wrote to memory of 4164	3748	cmd.exe	87
PID 3748 wrote to memory of 4164	3748	cmd.exe	87
PID 3552 wrote to memory of 1208	3552	necrumBypas3s (1).exe	95
PID 3552 wrote to memory of 1208	3552	necrumBypas3s (1).exe	95
PID 3552 wrote to memory of 4520	3552	necrumBypas3s (1).exe	97
PID 3552 wrote to memory of 4520	3552	necrumBypas3s (1).exe	97

C:\Users\Admin\AppData\Local\Temp\necrumBypas3s (1).exe
"C:\Users\Admin\AppData\Local\Temp\necrumBypas3s (1).exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\necrumBypas3s (1).exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3748
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\necrumBypas3s (1).exe" MD5
    3⤵
    PID:1144
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:1936
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:4164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c warp-cli connect
  2⤵
  PID:1208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c warp-cli connect
  2⤵
  PID:4520