aeba954a9b3afa58807aad0b266745c8bad637ac2cfedf3cfb4f11745ad85fea

Analysis

Target

aeba954a9b3afa58807aad0b266745c8bad637ac2cfedf3cfb4f11745ad85fea.exe
Size

1008KB
MD5

8d17b6f739b852720928542609534f25
SHA1

ba078a4a2adc7766e94d36b53c2d1082b4e21be3
SHA256

aeba954a9b3afa58807aad0b266745c8bad637ac2cfedf3cfb4f11745ad85fea
SHA512

74cdb18a02f0d31051d1b598677a364106a1d0d07ba5db6dd4a019dc6af9df919307eb9a9c8be8c4945adf3cf458b07b501ce7c63fc396fb9a04b3ff3104607b

Score

1^/10

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

aeba954a9b3afa58807aad0b266745c8bad637ac2cfedf3cfb4f11745ad85fea.exe

pid	process
1788	aeba954a9b3afa58807aad0b266745c8bad637ac2cfedf3cfb4f11745ad85fea.exe
1788	aeba954a9b3afa58807aad0b266745c8bad637ac2cfedf3cfb4f11745ad85fea.exe
1788	aeba954a9b3afa58807aad0b266745c8bad637ac2cfedf3cfb4f11745ad85fea.exe
1788	aeba954a9b3afa58807aad0b266745c8bad637ac2cfedf3cfb4f11745ad85fea.exe
1788	aeba954a9b3afa58807aad0b266745c8bad637ac2cfedf3cfb4f11745ad85fea.exe
1788	aeba954a9b3afa58807aad0b266745c8bad637ac2cfedf3cfb4f11745ad85fea.exe
1788	aeba954a9b3afa58807aad0b266745c8bad637ac2cfedf3cfb4f11745ad85fea.exe
1788	aeba954a9b3afa58807aad0b266745c8bad637ac2cfedf3cfb4f11745ad85fea.exe
1788	aeba954a9b3afa58807aad0b266745c8bad637ac2cfedf3cfb4f11745ad85fea.exe
1788	aeba954a9b3afa58807aad0b266745c8bad637ac2cfedf3cfb4f11745ad85fea.exe
1788	aeba954a9b3afa58807aad0b266745c8bad637ac2cfedf3cfb4f11745ad85fea.exe
1788	aeba954a9b3afa58807aad0b266745c8bad637ac2cfedf3cfb4f11745ad85fea.exe
1788	aeba954a9b3afa58807aad0b266745c8bad637ac2cfedf3cfb4f11745ad85fea.exe
1788	aeba954a9b3afa58807aad0b266745c8bad637ac2cfedf3cfb4f11745ad85fea.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

aeba954a9b3afa58807aad0b266745c8bad637ac2cfedf3cfb4f11745ad85fea.exe

description	pid	process	target process
PID 1788 wrote to memory of 3692	1788	aeba954a9b3afa58807aad0b266745c8bad637ac2cfedf3cfb4f11745ad85fea.exe	cmd.exe
PID 1788 wrote to memory of 3692	1788	aeba954a9b3afa58807aad0b266745c8bad637ac2cfedf3cfb4f11745ad85fea.exe	cmd.exe
PID 1788 wrote to memory of 3692	1788	aeba954a9b3afa58807aad0b266745c8bad637ac2cfedf3cfb4f11745ad85fea.exe	cmd.exe

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\_deleteme.bat
2⤵
PID:3692

C:\Users\Admin\AppData\Local\Temp\_deleteme.bat
Filesize
248B

MD5
52899388862a4c740eec2540ef22495f

SHA1
6ff6f1a7d99ea082f25efd0c0cd2ae989669829e

SHA256
601d131aed915a0ed2358359cddb23bb9fe6b0aee246af9b6a9a0353bddb0b2f

SHA512
928bfc6c8f1a9b7b3c20ab4794b39f75f091a42e7ea6e273b2f4a121671e426b2bc9a11f9bd4c64997ae2fe080cd781c890d21a3b9bbb123ae56c791a8611443

Download Submit
memory/3692-130-0x0000000000000000-mapping.dmp

Download