6ad2d19bd7c479748fe2dd1d12989f883ad264ed0854948828d2d2d6870e528e

Analysis

max time kernel
50s
max time network
93s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 12:10 UTC

Target

gadjuka_tfile_ru.exe
Size

507KB
MD5

12e86824a374faf32a242c956f387bf3
SHA1

a87d6031ad523146395a2837a0dafbaf23ca595d
SHA256

dd97040d5a029fc71933e9ddf343282013e69ac64ea2ae9dc04cc502c977d7c6
SHA512

3213cc4f5a61b53970d7761364faee7a1e9788abbd82c1a589dc316bf06c864c429a334d12c32061b9472859e0b6ab80677445582710ffff9e8d2768d34c3e4b
SSDEEP

6144:yuv9DZap6llJesZ4Z64SOe+K2OLvrsbmPVlqV+MIIQzccWK1as5foPclCzIcN5fF:0KYjw2O3sbmL5asaPjz4Q8W

Score

1^/10

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1976	1712	gadjuka_tfile_ru.exe	28
PID 1712 wrote to memory of 1976	1712	gadjuka_tfile_ru.exe	28
PID 1712 wrote to memory of 1976	1712	gadjuka_tfile_ru.exe	28
PID 1712 wrote to memory of 1976	1712	gadjuka_tfile_ru.exe	28
PID 1712 wrote to memory of 1504	1712	gadjuka_tfile_ru.exe	29
PID 1712 wrote to memory of 1504	1712	gadjuka_tfile_ru.exe	29
PID 1712 wrote to memory of 1504	1712	gadjuka_tfile_ru.exe	29
PID 1712 wrote to memory of 1504	1712	gadjuka_tfile_ru.exe	29

C:\Users\Admin\AppData\Local\Temp\gadjuka_tfile_ru.exe
"C:\Users\Admin\AppData\Local\Temp\gadjuka_tfile_ru.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Users\Admin\AppData\Local\Temp\gadjuka_tfile_ru.exe
  start
  2⤵
  PID:1976
- C:\Users\Admin\AppData\Local\Temp\gadjuka_tfile_ru.exe
  watch
  2⤵
  PID:1504

No results found

memory/1504-62-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1504-65-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1712-54-0x00000000760C1000-0x00000000760C3000-memory.dmp

Filesize
8KB

Download
memory/1712-58-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1712-60-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1976-61-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1976-63-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1976-64-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download