c9aae8022ed2d9b73914c2c2505045de4fab834d69607bbc5397d66847033efd

Analysis

max time kernel
130s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 18:46

Target

c9aae8022ed2d9b73914c2c2505045de4fab834d69607bbc5397d66847033efd.exe
Size

425KB
MD5

9141b69856f6fca2ed3f87d7cf7da627
SHA1

74279c84f321fe6209778167895f1a2d5c50cdad
SHA256

c9aae8022ed2d9b73914c2c2505045de4fab834d69607bbc5397d66847033efd
SHA512

dc6c9d59f69f1c5c1afd83cd8ee8be70d1093253534ed25e20d0899fbce9072ed7d47e81b13b35b70c771d27beb10c5633a3dd7e789ca2833280e4d173889d6b
SSDEEP

12288:gBao9NPJ4LqAdG4c6OkTNXJnzzqcWvGA1:Cj9NPlAd86VNXJnvqLGq

Score

4^/10

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\F_Server.exe	c9aae8022ed2d9b73914c2c2505045de4fab834d69607bbc5397d66847033efd.exe
File created	C:\Program Files\F_Server.exe	c9aae8022ed2d9b73914c2c2505045de4fab834d69607bbc5397d66847033efd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 4604	3208	c9aae8022ed2d9b73914c2c2505045de4fab834d69607bbc5397d66847033efd.exe	82
PID 3208 wrote to memory of 4604	3208	c9aae8022ed2d9b73914c2c2505045de4fab834d69607bbc5397d66847033efd.exe	82

C:\Users\Admin\AppData\Local\Temp\c9aae8022ed2d9b73914c2c2505045de4fab834d69607bbc5397d66847033efd.exe
"C:\Users\Admin\AppData\Local\Temp\c9aae8022ed2d9b73914c2c2505045de4fab834d69607bbc5397d66847033efd.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" ¨Á
  2⤵
  PID:4604

memory/3208-132-0x0000000000400000-0x0000000000C02000-memory.dmp

Filesize
8.0MB

Download
memory/3208-133-0x0000000000400000-0x0000000000C02000-memory.dmp

Filesize
8.0MB

Download