ffb6cf0788bc9fef9314085cf23fbdf87bfde9c3b78f014d5fd3e76d769cc82c

Analysis

Target

ffb6cf0788bc9fef9314085cf23fbdf87bfde9c3b78f014d5fd3e76d769cc82c.exe
Size

132KB
MD5

3a85cbd54b6c1afadaf06fbc6f1ef9b4
SHA1

9c4a8786144bc43b06e37e2cbd9ecb4cb0332627
SHA256

ffb6cf0788bc9fef9314085cf23fbdf87bfde9c3b78f014d5fd3e76d769cc82c
SHA512

ec5d74354d29089ec70750987176ee8282575e3db038cc79b8f4b58c71672ea5ece93f0ae8b8aca4cf75e12ede927cbf3d873d0dc1f26da64b5ce88de8420b16

Score

1^/10

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

ffb6cf0788bc9fef9314085cf23fbdf87bfde9c3b78f014d5fd3e76d769cc82c.exesvchost.exe

pid	Process
4576	ffb6cf0788bc9fef9314085cf23fbdf87bfde9c3b78f014d5fd3e76d769cc82c.exe
4576	ffb6cf0788bc9fef9314085cf23fbdf87bfde9c3b78f014d5fd3e76d769cc82c.exe
4576	ffb6cf0788bc9fef9314085cf23fbdf87bfde9c3b78f014d5fd3e76d769cc82c.exe
4576	ffb6cf0788bc9fef9314085cf23fbdf87bfde9c3b78f014d5fd3e76d769cc82c.exe
4576	ffb6cf0788bc9fef9314085cf23fbdf87bfde9c3b78f014d5fd3e76d769cc82c.exe
4576	ffb6cf0788bc9fef9314085cf23fbdf87bfde9c3b78f014d5fd3e76d769cc82c.exe
5028	svchost.exe
5028	svchost.exe
5028	svchost.exe
5028	svchost.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ffb6cf0788bc9fef9314085cf23fbdf87bfde9c3b78f014d5fd3e76d769cc82c.exe

description	pid	Process	procid_target
PID 4576 wrote to memory of 5028	4576	ffb6cf0788bc9fef9314085cf23fbdf87bfde9c3b78f014d5fd3e76d769cc82c.exe	80
PID 4576 wrote to memory of 5028	4576	ffb6cf0788bc9fef9314085cf23fbdf87bfde9c3b78f014d5fd3e76d769cc82c.exe	80
PID 4576 wrote to memory of 5028	4576	ffb6cf0788bc9fef9314085cf23fbdf87bfde9c3b78f014d5fd3e76d769cc82c.exe	80
PID 4576 wrote to memory of 5028	4576	ffb6cf0788bc9fef9314085cf23fbdf87bfde9c3b78f014d5fd3e76d769cc82c.exe	80

C:\Users\Admin\AppData\Local\Temp\ffb6cf0788bc9fef9314085cf23fbdf87bfde9c3b78f014d5fd3e76d769cc82c.exe
"C:\Users\Admin\AppData\Local\Temp\ffb6cf0788bc9fef9314085cf23fbdf87bfde9c3b78f014d5fd3e76d769cc82c.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe "C:\Users\Admin\AppData\Local\Temp\ffb6cf0788bc9fef9314085cf23fbdf87bfde9c3b78f014d5fd3e76d769cc82c.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5028

memory/4576-130-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4576-133-0x00000000006E0000-0x00000000006E6000-memory.dmp

Filesize
24KB

Download
memory/5028-132-0x0000000000000000-mapping.dmp

Download
memory/5028-134-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5028-136-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5028-135-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5028-137-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5028-138-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5028-139-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5028-140-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5028-146-0x0000000002690000-0x0000000002696000-memory.dmp

Filesize
24KB

Download