b7a2def2630cbbca20d06f0d40ceaf00f8df471adb12f62efbeb513681cf4878

Analysis

max time kernel
101s
max time network
106s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
15/04/2025, 23:20

Target

quarantine/VcYJXcL.exe
Size

13.5MB
MD5

a42a7864ee588e5627a17cc5b36a8cae
SHA1

3713244300e87a512ad10382571c98a08fd13155
SHA256

3d4915f94462dda1b3af5ca1ee39740e14644807fb743403e55c7b9a92101b7f
SHA512

2b86e5a3d0dcea2aa30731edbc1bf30251b1f5c0ebb24fcee772f8c9f4b0c1d5e11b8ebc633b4c4fd15f301dba0caf67114502e142efb5af3789114dd1a4490e
SSDEEP

393216:7lzh+J9e0FamFZOt7NUIaaHXDUJFbSflHjB0DjY31Z1CPwDv3uFh:7lz2s0FfZ2DUJFbSflHjB0Djm

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 5288	1632	VcYJXcL.exe	79
PID 1632 wrote to memory of 5288	1632	VcYJXcL.exe	79

C:\Users\Admin\AppData\Local\Temp\quarantine\VcYJXcL.exe
"C:\Users\Admin\AppData\Local\Temp\quarantine\VcYJXcL.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c (for /L %i in (0,1,15) do (del "C:\Users\Admin\AppData\Local\Temp\QUARAN~1\VcYJXcL.exe" & if not exist "C:\Users\Admin\AppData\Local\Temp\QUARAN~1\VcYJXcL.exe" (rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\QUARAN~1\VcYJXcL.exe" & exit)))
  2⤵
  PID:5288

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact