3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7

General

Target

3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
Size

551KB
MD5

3eb6593e42fb0f63c30f5215994074b1
SHA1

208c3a6c75b7b6b2f4a3ee93396b76cb9251896f
SHA256

3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7
SHA512

e853bace4a7532c4fe12c4ec6e9f45d668e9376c3b3ecbec739bc3db458f68697d7812771caad35f1f6e2b70eae0ddf10815e2bbc5ab4d7ed307a2db6d7f530d

Score

1^/10

Malware Config

Signatures

Suspicious behavior: MapViewOfSection 10 IoCs

Processes:

3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe

pid	process
1836	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
1724	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
1976	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
1480	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
1180	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
2028	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
588	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
588	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
2036	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
688	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe

description	pid	process	target process
PID 1836 wrote to memory of 1944	1836	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	MSBuild.exe
PID 1836 wrote to memory of 1944	1836	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	MSBuild.exe
PID 1836 wrote to memory of 1944	1836	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	MSBuild.exe
PID 1836 wrote to memory of 1944	1836	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	MSBuild.exe
PID 1836 wrote to memory of 1944	1836	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	MSBuild.exe
PID 1836 wrote to memory of 1724	1836	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
PID 1836 wrote to memory of 1724	1836	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
PID 1836 wrote to memory of 1724	1836	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
PID 1836 wrote to memory of 1724	1836	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
PID 1724 wrote to memory of 952	1724	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	MSBuild.exe
PID 1724 wrote to memory of 952	1724	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	MSBuild.exe
PID 1724 wrote to memory of 952	1724	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	MSBuild.exe
PID 1724 wrote to memory of 952	1724	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	MSBuild.exe
PID 1724 wrote to memory of 952	1724	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	MSBuild.exe
PID 1724 wrote to memory of 1976	1724	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
PID 1724 wrote to memory of 1976	1724	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
PID 1724 wrote to memory of 1976	1724	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
PID 1724 wrote to memory of 1976	1724	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
PID 1976 wrote to memory of 1708	1976	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	MSBuild.exe
PID 1976 wrote to memory of 1708	1976	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	MSBuild.exe
PID 1976 wrote to memory of 1708	1976	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	MSBuild.exe
PID 1976 wrote to memory of 1708	1976	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	MSBuild.exe
PID 1976 wrote to memory of 1708	1976	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	MSBuild.exe
PID 1976 wrote to memory of 1480	1976	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
PID 1976 wrote to memory of 1480	1976	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
PID 1976 wrote to memory of 1480	1976	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
PID 1976 wrote to memory of 1480	1976	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
PID 1480 wrote to memory of 1116	1480	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	MSBuild.exe
PID 1480 wrote to memory of 1116	1480	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	MSBuild.exe
PID 1480 wrote to memory of 1116	1480	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	MSBuild.exe
PID 1480 wrote to memory of 1116	1480	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	MSBuild.exe
PID 1480 wrote to memory of 1116	1480	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	MSBuild.exe
PID 1480 wrote to memory of 1180	1480	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
PID 1480 wrote to memory of 1180	1480	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
PID 1480 wrote to memory of 1180	1480	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
PID 1480 wrote to memory of 1180	1480	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
PID 1180 wrote to memory of 1720	1180	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	MSBuild.exe
PID 1180 wrote to memory of 1720	1180	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	MSBuild.exe
PID 1180 wrote to memory of 1720	1180	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	MSBuild.exe
PID 1180 wrote to memory of 1720	1180	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	MSBuild.exe
PID 1180 wrote to memory of 1720	1180	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	MSBuild.exe
PID 1180 wrote to memory of 2028	1180	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
PID 1180 wrote to memory of 2028	1180	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
PID 1180 wrote to memory of 2028	1180	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
PID 1180 wrote to memory of 2028	1180	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
PID 2028 wrote to memory of 1772	2028	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	MSBuild.exe
PID 2028 wrote to memory of 1772	2028	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	MSBuild.exe
PID 2028 wrote to memory of 1772	2028	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	MSBuild.exe
PID 2028 wrote to memory of 1772	2028	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	MSBuild.exe
PID 2028 wrote to memory of 1772	2028	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	MSBuild.exe
PID 2028 wrote to memory of 588	2028	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
PID 2028 wrote to memory of 588	2028	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
PID 2028 wrote to memory of 588	2028	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
PID 2028 wrote to memory of 588	2028	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
PID 588 wrote to memory of 1888	588	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	MSBuild.exe
PID 588 wrote to memory of 1888	588	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	MSBuild.exe
PID 588 wrote to memory of 1888	588	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	MSBuild.exe
PID 588 wrote to memory of 1888	588	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	MSBuild.exe
PID 588 wrote to memory of 1888	588	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	MSBuild.exe
PID 588 wrote to memory of 2036	588	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
PID 588 wrote to memory of 2036	588	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
PID 588 wrote to memory of 2036	588	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
PID 588 wrote to memory of 2036	588	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
PID 2036 wrote to memory of 1384	2036	3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
"C:\Users\Admin\AppData\Local\Temp\3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1836

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
PID:1944

C:\Users\Admin\AppData\Local\Temp\3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
"C:\Users\Admin\AppData\Local\Temp\3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe"
2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
3⤵
PID:952

C:\Users\Admin\AppData\Local\Temp\3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
"C:\Users\Admin\AppData\Local\Temp\3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe"
3⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
4⤵
PID:1708

C:\Users\Admin\AppData\Local\Temp\3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
"C:\Users\Admin\AppData\Local\Temp\3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe"
4⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1480

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
5⤵
PID:1116

C:\Users\Admin\AppData\Local\Temp\3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
"C:\Users\Admin\AppData\Local\Temp\3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe"
5⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1180

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
6⤵
PID:1720

C:\Users\Admin\AppData\Local\Temp\3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
"C:\Users\Admin\AppData\Local\Temp\3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe"
6⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
7⤵
PID:1772

C:\Users\Admin\AppData\Local\Temp\3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
"C:\Users\Admin\AppData\Local\Temp\3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe"
7⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:588

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
8⤵
PID:1888

C:\Users\Admin\AppData\Local\Temp\3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
"C:\Users\Admin\AppData\Local\Temp\3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe"
8⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
9⤵
PID:1384

C:\Users\Admin\AppData\Local\Temp\3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
"C:\Users\Admin\AppData\Local\Temp\3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe"
9⤵
- Suspicious behavior: MapViewOfSection
PID:688

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
10⤵
PID:1204

C:\Users\Admin\AppData\Local\Temp\3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
"C:\Users\Admin\AppData\Local\Temp\3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe"
10⤵
PID:1572

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/588-65-0x0000000000000000-mapping.dmp

Download
memory/588-66-0x0000000000940000-0x0000000000964000-memory.dmp

Filesize
144KB

Download
memory/688-70-0x0000000000940000-0x0000000000964000-memory.dmp

Filesize
144KB

Download
memory/688-69-0x0000000000000000-mapping.dmp

Download
memory/1180-62-0x0000000000940000-0x0000000000964000-memory.dmp

Filesize
144KB

Download
memory/1180-61-0x0000000000000000-mapping.dmp

Download
memory/1480-60-0x0000000000940000-0x0000000000964000-memory.dmp

Filesize
144KB

Download
memory/1480-59-0x0000000000000000-mapping.dmp

Download
memory/1572-72-0x0000000000940000-0x0000000000964000-memory.dmp

Filesize
144KB

Download
memory/1572-71-0x0000000000000000-mapping.dmp

Download
memory/1724-56-0x0000000000940000-0x0000000000964000-memory.dmp

Filesize
144KB

Download
memory/1724-55-0x0000000000000000-mapping.dmp

Download
memory/1836-54-0x0000000000940000-0x0000000000964000-memory.dmp

Filesize
144KB

Download
memory/1976-58-0x0000000000940000-0x0000000000964000-memory.dmp

Filesize
144KB

Download
memory/1976-57-0x0000000000000000-mapping.dmp

Download
memory/2028-64-0x0000000000940000-0x0000000000964000-memory.dmp

Filesize
144KB

Download
memory/2028-63-0x0000000000000000-mapping.dmp

Download
memory/2036-68-0x0000000000940000-0x0000000000964000-memory.dmp

Filesize
144KB

Download
memory/2036-67-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing