ea3ecdc9d1e7408f70fa211f799fa196393a98111080491da6a2c9ffe9fc131a

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
08-11-2023 03:02

Target

25540f55ae5a200dd9635f60a3b62458b6d95386d0d92eab2282facc6f51084e.exe
Size

349KB
MD5

c77ed66a06eaa6254d70a50e91fe68f6
SHA1

4523ac24ed151f6cd5cfceba37ad725e1a8afc0f
SHA256

25540f55ae5a200dd9635f60a3b62458b6d95386d0d92eab2282facc6f51084e
SHA512

d22fbea9fe6baa38ca6e3bd6d9324f70e9bf035a456a65751079b55968cc18920f3dbff69de97384ef2e27f27c54ea8597456f6176d035b8c220c672a992590b
SSDEEP

6144:tMVvcrQJL4IYYfnnZYJo57RuoGBfu9w9RzixhDeICv1M/Y8Q5AVSiwMpr5WR5oL1:2VE6VYYfIwRu7ICv1M/Y8Q5AVSiwcr5L

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

25540f55ae5a200dd9635f60a3b62458b6d95386d0d92eab2282facc6f51084e.exe

description	pid	process	target process
PID 2056 wrote to memory of 1236	2056	25540f55ae5a200dd9635f60a3b62458b6d95386d0d92eab2282facc6f51084e.exe	RegAsm.exe
PID 2056 wrote to memory of 1236	2056	25540f55ae5a200dd9635f60a3b62458b6d95386d0d92eab2282facc6f51084e.exe	RegAsm.exe
PID 2056 wrote to memory of 1236	2056	25540f55ae5a200dd9635f60a3b62458b6d95386d0d92eab2282facc6f51084e.exe	RegAsm.exe
PID 2056 wrote to memory of 1236	2056	25540f55ae5a200dd9635f60a3b62458b6d95386d0d92eab2282facc6f51084e.exe	RegAsm.exe
PID 2056 wrote to memory of 1236	2056	25540f55ae5a200dd9635f60a3b62458b6d95386d0d92eab2282facc6f51084e.exe	RegAsm.exe
PID 2056 wrote to memory of 1236	2056	25540f55ae5a200dd9635f60a3b62458b6d95386d0d92eab2282facc6f51084e.exe	RegAsm.exe
PID 2056 wrote to memory of 1236	2056	25540f55ae5a200dd9635f60a3b62458b6d95386d0d92eab2282facc6f51084e.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\25540f55ae5a200dd9635f60a3b62458b6d95386d0d92eab2282facc6f51084e.exe
"C:\Users\Admin\AppData\Local\Temp\25540f55ae5a200dd9635f60a3b62458b6d95386d0d92eab2282facc6f51084e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2056

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
2⤵
PID:1236

memory/2056-0-0x0000000074880000-0x0000000074F6E000-memory.dmp

Filesize
6.9MB

Download
memory/2056-1-0x00000000009D0000-0x0000000000A2E000-memory.dmp

Filesize
376KB

Download
memory/2056-2-0x0000000000420000-0x0000000000474000-memory.dmp

Filesize
336KB

Download
memory/2056-3-0x0000000074880000-0x0000000074F6E000-memory.dmp

Filesize
6.9MB

Download
memory/2056-4-0x0000000004790000-0x00000000047D0000-memory.dmp

Filesize
256KB

Download
memory/2056-5-0x0000000000470000-0x000000000047A000-memory.dmp

Filesize
40KB

Download
memory/2056-6-0x0000000074880000-0x0000000074F6E000-memory.dmp

Filesize
6.9MB

Download