8f381987b6d04acb2f13d81524cd91deed670b4e678d34fc3960278a28cc4eb6

Analysis

Target
file.exe
Size 336KB
Sample210111-c386tmjkr6
SHA256 8f381987b6d04acb2f13d81524cd91deed670b4e678d34fc3960278a28cc4eb6
MD5 df6b7dda065438d3b006942b9124c2dc
SHA1 daae524c4d9a3465bb13e6193f48b565de3def1d
SHA512 54e1bb080d0f0ad352934ca6558b50e3c36b64f1556d9bad6c667302f946fb8ba9fab4e22c97edc089b0d98356117d8c96a1be482031de1eb2811337b9c06b6d
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: MapViewOfSection 3 IoCs

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 3596	4688	file.exe	76
PID 4688 wrote to memory of 3596	4688	file.exe	76
PID 4688 wrote to memory of 3596	4688	file.exe	76
PID 4688 wrote to memory of 3472	4688	file.exe	77
PID 4688 wrote to memory of 3472	4688	file.exe	77
PID 4688 wrote to memory of 3472	4688	file.exe	77
PID 3472 wrote to memory of 3008	3472	file.exe	78
PID 3472 wrote to memory of 3008	3472	file.exe	78
PID 3472 wrote to memory of 3008	3472	file.exe	78
PID 3472 wrote to memory of 416	3472	file.exe	79
PID 3472 wrote to memory of 416	3472	file.exe	79
PID 3472 wrote to memory of 416	3472	file.exe	79
PID 416 wrote to memory of 2236	416	file.exe	80
PID 416 wrote to memory of 2236	416	file.exe	80
PID 416 wrote to memory of 2236	416	file.exe	80
PID 416 wrote to memory of 3712	416	file.exe	81
PID 416 wrote to memory of 3712	416	file.exe	81
PID 416 wrote to memory of 3712	416	file.exe	81

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  PID:3596
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3472
- - C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    3⤵
    PID:3008
- - C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    3⤵
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:416
  - - C:\Users\Admin\AppData\Local\Temp\file.exe
      "C:\Users\Admin\AppData\Local\Temp\file.exe"
      4⤵
      PID:2236
  - - C:\Users\Admin\AppData\Local\Temp\file.exe
      "C:\Users\Admin\AppData\Local\Temp\file.exe"
      4⤵
      PID:3712