0e2e2f6590d4ff4fb49a8854413c50cfe5b74fa3aa4f40ad05bd5e865a0515eb

Analysis

max time kernel
131s
max time network
132s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 16:50

Target

AmeChan/AmeChan.exe
Size

625KB
MD5

b58b01cf31198af51541beba1f4b2b05
SHA1

74ea44d46aeed8d2a01897f42c001936942f48ab
SHA256

ae23a0847a3598c27a0e44614a7bfa3afb225840ca150a67aac2645006a27abb
SHA512

f378b0d174cee87e7541014f65d0a14b0bc755e6483c36b3591a3f597efa6e89f1ceaf8ec40af44a95354c5b0c3ac2408a7acc30c743bd1b959630bc286e266d
SSDEEP

6144:5Vls9u4ZoQpF6LH19Gt5hAu9itBwbKTaaHpGAHa5CP:T+7o26HtBweODYP

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2808	AmeChan.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 2600	2808	AmeChan.exe	27
PID 2808 wrote to memory of 2600	2808	AmeChan.exe	27
PID 2808 wrote to memory of 2600	2808	AmeChan.exe	27
PID 2808 wrote to memory of 2600	2808	AmeChan.exe	27

C:\Users\Admin\AppData\Local\Temp\AmeChan\AmeChan.exe
"C:\Users\Admin\AppData\Local\Temp\AmeChan\AmeChan.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Users\Admin\AppData\Local\Temp\AmeChan\UnityCrashHandler32.exe
  "C:\Users\Admin\AppData\Local\Temp\AmeChan\UnityCrashHandler32.exe" --attach 2808 1052672
  2⤵
  PID:2600

memory/2808-0-0x0000000000140000-0x0000000000150000-memory.dmp

Filesize
64KB

Download
memory/2808-1-0x0000000000120000-0x0000000000130000-memory.dmp

Filesize
64KB

Download
memory/2808-2-0x0000000001E80000-0x0000000001E90000-memory.dmp

Filesize
64KB

Download
memory/2808-4-0x0000000000120000-0x0000000000130000-memory.dmp

Filesize
64KB

Download
memory/2808-3-0x0000000000140000-0x0000000000150000-memory.dmp

Filesize
64KB

Download
memory/2808-5-0x0000000001E80000-0x0000000001E90000-memory.dmp

Filesize
64KB

Download