9a7b811aff67ed3aca54a34df7ba6030bf06a3c65db603bc8f8cde338ef1dec7

Analysis

Target

84c278c9ac112f94b324e0f99a6dce7746f17eb60688df88d3fa7d72e4a0f558.exe
Size

435KB
MD5

06e67970894da9ae379becfa19c0ef64
SHA1

fdbfaa1a2d407dbb1e4535fe98882a0e626327d6
SHA256

84c278c9ac112f94b324e0f99a6dce7746f17eb60688df88d3fa7d72e4a0f558
SHA512

c5d81c8144acbda22d83acd3eb2bc588a83c2463c5ec9b04bfb4205983f72bf0414cdaca45872c887ac7a37c4731a1e3c190828eae237dfe7d445e465fcd3137

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1376	85d378d9ad223g95b435f0g99a7edf7757g27fb70788eg88e4ga7e73f5a0g668.exe

Loads dropped DLL 1 IoCs

pid	Process
240	84c278c9ac112f94b324e0f99a6dce7746f17eb60688df88d3fa7d72e4a0f558.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
240	84c278c9ac112f94b324e0f99a6dce7746f17eb60688df88d3fa7d72e4a0f558.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 240 wrote to memory of 1376	240	84c278c9ac112f94b324e0f99a6dce7746f17eb60688df88d3fa7d72e4a0f558.exe	29
PID 240 wrote to memory of 1376	240	84c278c9ac112f94b324e0f99a6dce7746f17eb60688df88d3fa7d72e4a0f558.exe	29
PID 240 wrote to memory of 1376	240	84c278c9ac112f94b324e0f99a6dce7746f17eb60688df88d3fa7d72e4a0f558.exe	29
PID 240 wrote to memory of 1376	240	84c278c9ac112f94b324e0f99a6dce7746f17eb60688df88d3fa7d72e4a0f558.exe	29

C:\Users\Admin\AppData\Local\Temp\84c278c9ac112f94b324e0f99a6dce7746f17eb60688df88d3fa7d72e4a0f558.exe
"C:\Users\Admin\AppData\Local\Temp\84c278c9ac112f94b324e0f99a6dce7746f17eb60688df88d3fa7d72e4a0f558.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:240
- C:\Users\Admin\AppData\Roaming\services\85d378d9ad223g95b435f0g99a7edf7757g27fb70788eg88e4ga7e73f5a0g668.exe
  C:\Users\Admin\AppData\Roaming\services\85d378d9ad223g95b435f0g99a7edf7757g27fb70788eg88e4ga7e73f5a0g668.exe
  2⤵
  - Executes dropped EXE
  PID:1376

memory/240-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download