Analysis
-
max time kernel
148s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
19-04-2022 12:21
Static task
static1
Behavioral task
behavioral1
Sample
3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
Resource
win7-20220414-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
Resource
win10v2004-20220414-en
0 signatures
0 seconds
General
-
Target
3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe
-
Size
551KB
-
MD5
3eb6593e42fb0f63c30f5215994074b1
-
SHA1
208c3a6c75b7b6b2f4a3ee93396b76cb9251896f
-
SHA256
3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7
-
SHA512
e853bace4a7532c4fe12c4ec6e9f45d668e9376c3b3ecbec739bc3db458f68697d7812771caad35f1f6e2b70eae0ddf10815e2bbc5ab4d7ed307a2db6d7f530d
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: MapViewOfSection 10 IoCs
Processes:
3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exepid process 1836 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe 1724 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe 1976 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe 1480 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe 1180 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe 2028 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe 588 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe 588 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe 2036 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe 688 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exedescription pid process target process PID 1836 wrote to memory of 1944 1836 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe MSBuild.exe PID 1836 wrote to memory of 1944 1836 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe MSBuild.exe PID 1836 wrote to memory of 1944 1836 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe MSBuild.exe PID 1836 wrote to memory of 1944 1836 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe MSBuild.exe PID 1836 wrote to memory of 1944 1836 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe MSBuild.exe PID 1836 wrote to memory of 1724 1836 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe PID 1836 wrote to memory of 1724 1836 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe PID 1836 wrote to memory of 1724 1836 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe PID 1836 wrote to memory of 1724 1836 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe PID 1724 wrote to memory of 952 1724 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe MSBuild.exe PID 1724 wrote to memory of 952 1724 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe MSBuild.exe PID 1724 wrote to memory of 952 1724 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe MSBuild.exe PID 1724 wrote to memory of 952 1724 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe MSBuild.exe PID 1724 wrote to memory of 952 1724 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe MSBuild.exe PID 1724 wrote to memory of 1976 1724 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe PID 1724 wrote to memory of 1976 1724 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe PID 1724 wrote to memory of 1976 1724 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe PID 1724 wrote to memory of 1976 1724 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe PID 1976 wrote to memory of 1708 1976 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe MSBuild.exe PID 1976 wrote to memory of 1708 1976 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe MSBuild.exe PID 1976 wrote to memory of 1708 1976 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe MSBuild.exe PID 1976 wrote to memory of 1708 1976 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe MSBuild.exe PID 1976 wrote to memory of 1708 1976 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe MSBuild.exe PID 1976 wrote to memory of 1480 1976 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe PID 1976 wrote to memory of 1480 1976 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe PID 1976 wrote to memory of 1480 1976 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe PID 1976 wrote to memory of 1480 1976 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe PID 1480 wrote to memory of 1116 1480 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe MSBuild.exe PID 1480 wrote to memory of 1116 1480 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe MSBuild.exe PID 1480 wrote to memory of 1116 1480 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe MSBuild.exe PID 1480 wrote to memory of 1116 1480 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe MSBuild.exe PID 1480 wrote to memory of 1116 1480 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe MSBuild.exe PID 1480 wrote to memory of 1180 1480 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe PID 1480 wrote to memory of 1180 1480 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe PID 1480 wrote to memory of 1180 1480 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe PID 1480 wrote to memory of 1180 1480 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe PID 1180 wrote to memory of 1720 1180 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe MSBuild.exe PID 1180 wrote to memory of 1720 1180 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe MSBuild.exe PID 1180 wrote to memory of 1720 1180 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe MSBuild.exe PID 1180 wrote to memory of 1720 1180 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe MSBuild.exe PID 1180 wrote to memory of 1720 1180 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe MSBuild.exe PID 1180 wrote to memory of 2028 1180 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe PID 1180 wrote to memory of 2028 1180 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe PID 1180 wrote to memory of 2028 1180 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe PID 1180 wrote to memory of 2028 1180 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe PID 2028 wrote to memory of 1772 2028 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe MSBuild.exe PID 2028 wrote to memory of 1772 2028 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe MSBuild.exe PID 2028 wrote to memory of 1772 2028 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe MSBuild.exe PID 2028 wrote to memory of 1772 2028 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe MSBuild.exe PID 2028 wrote to memory of 1772 2028 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe MSBuild.exe PID 2028 wrote to memory of 588 2028 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe PID 2028 wrote to memory of 588 2028 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe PID 2028 wrote to memory of 588 2028 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe PID 2028 wrote to memory of 588 2028 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe PID 588 wrote to memory of 1888 588 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe MSBuild.exe PID 588 wrote to memory of 1888 588 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe MSBuild.exe PID 588 wrote to memory of 1888 588 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe MSBuild.exe PID 588 wrote to memory of 1888 588 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe MSBuild.exe PID 588 wrote to memory of 1888 588 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe MSBuild.exe PID 588 wrote to memory of 2036 588 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe PID 588 wrote to memory of 2036 588 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe PID 588 wrote to memory of 2036 588 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe PID 588 wrote to memory of 2036 588 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe PID 2036 wrote to memory of 1384 2036 3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe"C:\Users\Admin\AppData\Local\Temp\3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe"C:\Users\Admin\AppData\Local\Temp\3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe"2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe"C:\Users\Admin\AppData\Local\Temp\3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe"3⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe"C:\Users\Admin\AppData\Local\Temp\3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe"4⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"5⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe"C:\Users\Admin\AppData\Local\Temp\3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe"5⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"6⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe"C:\Users\Admin\AppData\Local\Temp\3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe"6⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"7⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe"C:\Users\Admin\AppData\Local\Temp\3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe"7⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:588 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"8⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe"C:\Users\Admin\AppData\Local\Temp\3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe"8⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"9⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe"C:\Users\Admin\AppData\Local\Temp\3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe"9⤵
- Suspicious behavior: MapViewOfSection
PID:688 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"10⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe"C:\Users\Admin\AppData\Local\Temp\3f444cc8ccb0bebbb6539b98d64e8fed19e2f7e6f950d18d63e9e8716012ccb7.exe"10⤵PID:1572