0b3a7f18411c12ea9a142b9fe9036988309f3ff2473ba55c4f3d200bb244255f

Analysis

Target

miniramon8.exe
Size

132KB
MD5

3a85cbd54b6c1afadaf06fbc6f1ef9b4
SHA1

9c4a8786144bc43b06e37e2cbd9ecb4cb0332627
SHA256

ffb6cf0788bc9fef9314085cf23fbdf87bfde9c3b78f014d5fd3e76d769cc82c
SHA512

ec5d74354d29089ec70750987176ee8282575e3db038cc79b8f4b58c71672ea5ece93f0ae8b8aca4cf75e12ede927cbf3d873d0dc1f26da64b5ce88de8420b16

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

miniramon8.exesvchost.exe

pid process

5100 miniramon8.exe
5100 miniramon8.exe
5100 miniramon8.exe
5100 miniramon8.exe
1688 svchost.exe
1688 svchost.exe
1688 svchost.exe
1688 svchost.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

miniramon8.exe

description	pid	process	target process
PID 5100 wrote to memory of 1688	5100	miniramon8.exe	svchost.exe
PID 5100 wrote to memory of 1688	5100	miniramon8.exe	svchost.exe
PID 5100 wrote to memory of 1688	5100	miniramon8.exe	svchost.exe
PID 5100 wrote to memory of 1688	5100	miniramon8.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\miniramon8.exe
"C:\Users\Admin\AppData\Local\Temp\miniramon8.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe "C:\Users\Admin\AppData\Local\Temp\miniramon8.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1688

memory/1688-136-0x0000000000000000-mapping.dmp

Download
memory/1688-138-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1688-137-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1688-139-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1688-141-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1688-142-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1688-140-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1688-143-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1688-149-0x0000000000DB0000-0x0000000000DB6000-memory.dmp

Filesize
24KB

Download
memory/5100-133-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5100-135-0x00000000009E0000-0x00000000009E6000-memory.dmp

Filesize
24KB

Download