aaf4fe2b9156b1b9372507b031bbab5c49f893fe652ea9d8729da31a1303153e

Analysis

Target
8900bde76eb764f75b27ca2157a52b03.exe
Size 1.5MB
Sample201117-331gtn5a4x
SHA256 aaf4fe2b9156b1b9372507b031bbab5c49f893fe652ea9d8729da31a1303153e
MD5 6a94e722a736eeabd2ba6f74124e593a
SHA1 d33de30c6083ac2d63be514b3d41a40bde1580f6
SHA512 2aa5d593757bb499424b58ac77b5526d64202028ede52b8c811ab1ac0c65b109327e8f41508010be02f53fb3bc72c9a1a657cc8546cf4697f895d73258faacd9
MD5 SHA1 SHA512

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
3328	8900bde76eb764f75b27ca2157a52b03.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 3328	4768	8900bde76eb764f75b27ca2157a52b03.exe	74
PID 4768 wrote to memory of 3328	4768	8900bde76eb764f75b27ca2157a52b03.exe	74
PID 4768 wrote to memory of 3328	4768	8900bde76eb764f75b27ca2157a52b03.exe	74

C:\Users\Admin\AppData\Local\Temp\8900bde76eb764f75b27ca2157a52b03.exe
"C:\Users\Admin\AppData\Local\Temp\8900bde76eb764f75b27ca2157a52b03.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Users\Admin\AppData\Local\Temp\is-PSIN7.tmp\8900bde76eb764f75b27ca2157a52b03.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-PSIN7.tmp\8900bde76eb764f75b27ca2157a52b03.tmp" /SL5="$20128,1298801,54272,C:\Users\Admin\AppData\Local\Temp\8900bde76eb764f75b27ca2157a52b03.exe"
  2⤵
  - Executes dropped EXE
  PID:3328

memory/4768-0-0x00000000023F0000-0x000000000250A000-memory.dmp

Download