e75e132f419523529e59356445a2f5bb1a031281344a85598ba5059e608f8549

Analysis

max time kernel
128s
max time network
159s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 11:08

Target

19aa66f2ca96ec4579ee920e9ec1c73c.exe
Size

433KB
MD5

19aa66f2ca96ec4579ee920e9ec1c73c
SHA1

fca845bb38cbd038912a9150566a13f5af2f1d4e
SHA256

e75e132f419523529e59356445a2f5bb1a031281344a85598ba5059e608f8549
SHA512

a3e3e76e3198bccd60d1235c403e108fad8bf674b5cead354b2a0e2e0439a80c13b18065ca41cd674b62599f805a862ab1c704c9ee01f22219c12131cf385581
SSDEEP

6144:w09XrpG6Bcwqh3SB4Rb3DggpBMDPnGQ5njdynEqLl4p8dVRWuR4AY+SoKm6+hwou:wAdG6OE6YNDPlh43lFVRWuGAYqu

Score

1^/10

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

19aa66f2ca96ec4579ee920e9ec1c73c.exe

pid process

2556 19aa66f2ca96ec4579ee920e9ec1c73c.exe
2556 19aa66f2ca96ec4579ee920e9ec1c73c.exe

pid	process
2556	19aa66f2ca96ec4579ee920e9ec1c73c.exe
2556	19aa66f2ca96ec4579ee920e9ec1c73c.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

19aa66f2ca96ec4579ee920e9ec1c73c.exe

description	pid	process	target process
PID 2556 wrote to memory of 2812	2556	19aa66f2ca96ec4579ee920e9ec1c73c.exe	MSBuild.exe
PID 2556 wrote to memory of 2812	2556	19aa66f2ca96ec4579ee920e9ec1c73c.exe	MSBuild.exe
PID 2556 wrote to memory of 2812	2556	19aa66f2ca96ec4579ee920e9ec1c73c.exe	MSBuild.exe
PID 2556 wrote to memory of 2812	2556	19aa66f2ca96ec4579ee920e9ec1c73c.exe	MSBuild.exe
PID 2556 wrote to memory of 2812	2556	19aa66f2ca96ec4579ee920e9ec1c73c.exe	MSBuild.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Users\Admin\AppData\Local\Temp\19aa66f2ca96ec4579ee920e9ec1c73c.exe"
2⤵
PID:2812

memory/2556-1-0x0000000000090000-0x0000000000190000-memory.dmp

Filesize
1024KB

Download
memory/2556-2-0x00000000002A0000-0x00000000002A2000-memory.dmp

Filesize
8KB

Download