6ad2d19bd7c479748fe2dd1d12989f883ad264ed0854948828d2d2d6870e528e

Analysis

max time kernel
310s
max time network
334s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 12:10

Target

gadjuka_tfile_ru.exe
Size

507KB
MD5

12e86824a374faf32a242c956f387bf3
SHA1

a87d6031ad523146395a2837a0dafbaf23ca595d
SHA256

dd97040d5a029fc71933e9ddf343282013e69ac64ea2ae9dc04cc502c977d7c6
SHA512

3213cc4f5a61b53970d7761364faee7a1e9788abbd82c1a589dc316bf06c864c429a334d12c32061b9472859e0b6ab80677445582710ffff9e8d2768d34c3e4b
SSDEEP

6144:yuv9DZap6llJesZ4Z64SOe+K2OLvrsbmPVlqV+MIIQzccWK1as5foPclCzIcN5fF:0KYjw2O3sbmL5asaPjz4Q8W

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 2724	3708	gadjuka_tfile_ru.exe	81
PID 3708 wrote to memory of 2724	3708	gadjuka_tfile_ru.exe	81
PID 3708 wrote to memory of 2724	3708	gadjuka_tfile_ru.exe	81
PID 3708 wrote to memory of 3596	3708	gadjuka_tfile_ru.exe	82
PID 3708 wrote to memory of 3596	3708	gadjuka_tfile_ru.exe	82
PID 3708 wrote to memory of 3596	3708	gadjuka_tfile_ru.exe	82

C:\Users\Admin\AppData\Local\Temp\gadjuka_tfile_ru.exe
"C:\Users\Admin\AppData\Local\Temp\gadjuka_tfile_ru.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Users\Admin\AppData\Local\Temp\gadjuka_tfile_ru.exe
  start
  2⤵
  PID:2724
- C:\Users\Admin\AppData\Local\Temp\gadjuka_tfile_ru.exe
  watch
  2⤵
  PID:3596

memory/2724-136-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/2724-137-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/2724-140-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/3596-138-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/3596-139-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/3596-141-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/3708-132-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/3708-135-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download