92f582920e73361b9cc4467e3aacc1c4159b6b337ac7d07f9e085968c2af1be0

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
05-11-2023 02:45

Target

8518ccc749c3934b1ce840e708d97659b02f1ba717205789d869dbb49103f5ce.exe
Size

1.1MB
MD5

9f061ed14a6be403487e1d5d9f57c1c7
SHA1

14b8bb53f104da83ac047a2133b3c16b1c417ae6
SHA256

8518ccc749c3934b1ce840e708d97659b02f1ba717205789d869dbb49103f5ce
SHA512

9af07665a41a5babc582a8b45f02068e7f198ed93edf32c2721448b84fc92c6ee2b1844694079a3d335e5222df27666e4b6ae5f9b6e2725923ad92f8ab94e9e2
SSDEEP

24576:ktfo6PTetbba1C/Ll3HoyhLLGmkB/YAuseX7KvO1YAuJMi+sPV3GykDfMNVzCOgk:Uo0etbba1C/Ll3HxHRpAuserKvpAuJMO

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

8518ccc749c3934b1ce840e708d97659b02f1ba717205789d869dbb49103f5ce.exe

description	pid	process	target process
PID 2220 wrote to memory of 2608	2220	8518ccc749c3934b1ce840e708d97659b02f1ba717205789d869dbb49103f5ce.exe	RegAsm.exe
PID 2220 wrote to memory of 2608	2220	8518ccc749c3934b1ce840e708d97659b02f1ba717205789d869dbb49103f5ce.exe	RegAsm.exe
PID 2220 wrote to memory of 2608	2220	8518ccc749c3934b1ce840e708d97659b02f1ba717205789d869dbb49103f5ce.exe	RegAsm.exe
PID 2220 wrote to memory of 2608	2220	8518ccc749c3934b1ce840e708d97659b02f1ba717205789d869dbb49103f5ce.exe	RegAsm.exe
PID 2220 wrote to memory of 2608	2220	8518ccc749c3934b1ce840e708d97659b02f1ba717205789d869dbb49103f5ce.exe	RegAsm.exe
PID 2220 wrote to memory of 2608	2220	8518ccc749c3934b1ce840e708d97659b02f1ba717205789d869dbb49103f5ce.exe	RegAsm.exe
PID 2220 wrote to memory of 2608	2220	8518ccc749c3934b1ce840e708d97659b02f1ba717205789d869dbb49103f5ce.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\8518ccc749c3934b1ce840e708d97659b02f1ba717205789d869dbb49103f5ce.exe
"C:\Users\Admin\AppData\Local\Temp\8518ccc749c3934b1ce840e708d97659b02f1ba717205789d869dbb49103f5ce.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2220

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
2⤵
PID:2608

memory/2220-0-0x00000000001D0000-0x00000000002E4000-memory.dmp

Filesize
1.1MB

Download
memory/2220-1-0x0000000073ED0000-0x00000000745BE000-memory.dmp

Filesize
6.9MB

Download
memory/2220-2-0x0000000001F90000-0x0000000001FE4000-memory.dmp

Filesize
336KB

Download
memory/2220-3-0x0000000073ED0000-0x00000000745BE000-memory.dmp

Filesize
6.9MB

Download
memory/2220-4-0x0000000004BE0000-0x0000000004C20000-memory.dmp

Filesize
256KB

Download
memory/2220-5-0x0000000000360000-0x000000000036A000-memory.dmp

Filesize
40KB

Download
memory/2220-6-0x0000000073ED0000-0x00000000745BE000-memory.dmp

Filesize
6.9MB

Download