5f3916cde8f3852fc370be7442e668f31a0d676f2ae912f88042481f972cc26a

Analysis

Target

e79d48bc650a2e1bd36d73f438826b8d.exe
Size

71KB
MD5

e79d48bc650a2e1bd36d73f438826b8d
SHA1

191e1644ca6b40fd8469d8013e4f931ac9877c18
SHA256

5f3916cde8f3852fc370be7442e668f31a0d676f2ae912f88042481f972cc26a
SHA512

7451442c8ff56ce0124efe429afbba480c71e56247f5cbebe83a0aa7107e9e3c3f68e891dfa928d1fc47be8c5fd715f59ebd252cf4d3d06f1eb471f6d422948d

Score

10^/10

suricata

suricata: ET MALWARE Possible Metasploit Payload Common Construct Bind_API (from server)
suricata: ET MALWARE Possible Metasploit Payload Common Construct Bind_API (from server)
suricata

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

e79d48bc650a2e1bd36d73f438826b8d.exe

description	pid	process	target process
PID 4112 wrote to memory of 4532	4112	e79d48bc650a2e1bd36d73f438826b8d.exe	svchost.exe
PID 4112 wrote to memory of 4532	4112	e79d48bc650a2e1bd36d73f438826b8d.exe	svchost.exe
PID 4112 wrote to memory of 4532	4112	e79d48bc650a2e1bd36d73f438826b8d.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\e79d48bc650a2e1bd36d73f438826b8d.exe
"C:\Users\Admin\AppData\Local\Temp\e79d48bc650a2e1bd36d73f438826b8d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4112

memory/4532-130-0x0000020320510000-0x0000020320545000-memory.dmp

Filesize
212KB

Download
memory/4532-131-0x0000020320550000-0x000002032058B000-memory.dmp

Filesize
236KB

Download
memory/4532-132-0x0000020322402000-0x000002032245B000-memory.dmp

Filesize
356KB

Download
memory/4532-133-0x00000203222E0000-0x000002032233F000-memory.dmp

Filesize
380KB

Download
memory/4532-134-0x000002032069B000-0x00000203206BC000-memory.dmp

Filesize
132KB

Download
memory/4532-135-0x0000020322340000-0x0000020322367000-memory.dmp

Filesize
156KB

Download
memory/4532-136-0x0000020320550000-0x000002032058B000-memory.dmp

Filesize
236KB

Download
memory/4532-137-0x0000020322402000-0x000002032245B000-memory.dmp

Filesize
356KB

Download
memory/4532-138-0x000002032069B000-0x00000203206BC000-memory.dmp

Filesize
132KB

Download