21ed5218d9bac37ebb8babbad609af06d9fd309b76ebf898a4a1e5657e83ed12

Analysis

max time kernel
4s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 12:52

Target

1fec80b2ddcb2414f8b33d684b594d18.exe
Size

589KB
MD5

1fec80b2ddcb2414f8b33d684b594d18
SHA1

57c64af5d590d13ebe3a6434723819e1bc171a24
SHA256

21ed5218d9bac37ebb8babbad609af06d9fd309b76ebf898a4a1e5657e83ed12
SHA512

28a91556f1e31966bd574d1c12d42caf83013d05958ab6fd2b3fa8c36599bc6f04c11fe5f914505c1f41edeeb70c08029b1ec23f080966af21d3075a478da941
SSDEEP

6144:cfcs4dTM9veh+aqrlGkH/u/c8iPOL1Md7NZQKtswxHCuwNfjGEFlj:cfqMve4D8kH/uziGRMdjQKt2NNfLD

Score

1^/10

Suspicious use of UnmapMainImage 3 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 1124	2984	1fec80b2ddcb2414f8b33d684b594d18.exe	29
PID 2984 wrote to memory of 1124	2984	1fec80b2ddcb2414f8b33d684b594d18.exe	29
PID 2984 wrote to memory of 1124	2984	1fec80b2ddcb2414f8b33d684b594d18.exe	29
PID 2984 wrote to memory of 1124	2984	1fec80b2ddcb2414f8b33d684b594d18.exe	29
PID 2984 wrote to memory of 1204	2984	1fec80b2ddcb2414f8b33d684b594d18.exe	28
PID 2984 wrote to memory of 1204	2984	1fec80b2ddcb2414f8b33d684b594d18.exe	28
PID 2984 wrote to memory of 1204	2984	1fec80b2ddcb2414f8b33d684b594d18.exe	28
PID 2984 wrote to memory of 1204	2984	1fec80b2ddcb2414f8b33d684b594d18.exe	28

C:\Users\Admin\AppData\Local\Temp\1fec80b2ddcb2414f8b33d684b594d18.exe
"C:\Users\Admin\AppData\Local\Temp\1fec80b2ddcb2414f8b33d684b594d18.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Users\Admin\AppData\Local\Temp\1fec80b2ddcb2414f8b33d684b594d18.exe
  watch
  2⤵
  - Suspicious use of UnmapMainImage
  PID:1204
- C:\Users\Admin\AppData\Local\Temp\1fec80b2ddcb2414f8b33d684b594d18.exe
  start
  2⤵
  - Suspicious use of UnmapMainImage
  PID:1124

memory/1124-2-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1124-4-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1204-3-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1204-5-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2984-0-0x0000000000230000-0x000000000024F000-memory.dmp

Filesize
124KB

Download
memory/2984-1-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download