e0af7b536a1c1c74e6ea269ea8cebcf63f5f159f7b971c716650eeba021b7bac

Analysis

Target
e0af7b536a1c1c74e6ea269ea8cebcf63f5f159f7b971c716650eeba021b7bac.exe
Size 144KB
Sample200830-b3yzg45bs2
SHA256 e0af7b536a1c1c74e6ea269ea8cebcf63f5f159f7b971c716650eeba021b7bac
MD5 73090c0a77b3871af285f1e064784093
SHA1 92193a80b759a0294479e46340ecd0633c457f24
SHA512 7f3cf7d742683480eaf56f96beffdf2a8c56cff76d47da4972f782ad216808e043aa4d63f80d3f8aa4096a25ce31fab3e82ec234653ee4061efef9bb77e8d0c9
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 792	2040	e0af7b536a1c1c74e6ea269ea8cebcf63f5f159f7b971c716650eeba021b7bac.exe	25
PID 2040 wrote to memory of 792	2040	e0af7b536a1c1c74e6ea269ea8cebcf63f5f159f7b971c716650eeba021b7bac.exe	25
PID 2040 wrote to memory of 792	2040	e0af7b536a1c1c74e6ea269ea8cebcf63f5f159f7b971c716650eeba021b7bac.exe	25
PID 2040 wrote to memory of 792	2040	e0af7b536a1c1c74e6ea269ea8cebcf63f5f159f7b971c716650eeba021b7bac.exe	25
PID 792 wrote to memory of 552	792	net.exe	27
PID 792 wrote to memory of 552	792	net.exe	27
PID 792 wrote to memory of 552	792	net.exe	27
PID 792 wrote to memory of 552	792	net.exe	27
PID 2040 wrote to memory of 1640	2040	e0af7b536a1c1c74e6ea269ea8cebcf63f5f159f7b971c716650eeba021b7bac.exe	31
PID 2040 wrote to memory of 1640	2040	e0af7b536a1c1c74e6ea269ea8cebcf63f5f159f7b971c716650eeba021b7bac.exe	31
PID 2040 wrote to memory of 1640	2040	e0af7b536a1c1c74e6ea269ea8cebcf63f5f159f7b971c716650eeba021b7bac.exe	31
PID 2040 wrote to memory of 1640	2040	e0af7b536a1c1c74e6ea269ea8cebcf63f5f159f7b971c716650eeba021b7bac.exe	31
PID 1640 wrote to memory of 1608	1640	net.exe	33
PID 1640 wrote to memory of 1608	1640	net.exe	33
PID 1640 wrote to memory of 1608	1640	net.exe	33
PID 1640 wrote to memory of 1608	1640	net.exe	33

C:\Users\Admin\AppData\Local\Temp\e0af7b536a1c1c74e6ea269ea8cebcf63f5f159f7b971c716650eeba021b7bac.exe
"C:\Users\Admin\AppData\Local\Temp\e0af7b536a1c1c74e6ea269ea8cebcf63f5f159f7b971c716650eeba021b7bac.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\net.exe
  net stop wscsvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:792
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop wscsvc
    3⤵
    PID:552
- C:\Windows\SysWOW64\net.exe
  net stop SharedAccess
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SharedAccess
    3⤵
    PID:1608