57c9823c30cdde694ac4e05072131babdca36de0c0ffa8fcb6ac87fa42de13e2

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 19:46

Target

391103a608e23c582ac2f7db131cd203.exe
Size

2.0MB
MD5

391103a608e23c582ac2f7db131cd203
SHA1

9ad1c8d6657d4d8b7510635c99c82b5dcb2ec314
SHA256

57c9823c30cdde694ac4e05072131babdca36de0c0ffa8fcb6ac87fa42de13e2
SHA512

486fdbd339bc8d1977c42531df4dbb19c7ab6fd1f8d20c9079a94fe6f048888791b8cef0013de5c6bd2d7a3826791aa841e44cce67fea09690a522df704e8612
SSDEEP

24576:ylnjI9LmIUu6TVaML+TKWmA7xvRVxTAdI6XRf2/PJRf2nRSvNCuDaKgFSqVaV8DM:ylY613ET8IIyOuoGlPeziTrlggeoL

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2904	2540	391103a608e23c582ac2f7db131cd203.exe	17
PID 2540 wrote to memory of 2904	2540	391103a608e23c582ac2f7db131cd203.exe	17
PID 2540 wrote to memory of 2904	2540	391103a608e23c582ac2f7db131cd203.exe	17
PID 2540 wrote to memory of 2904	2540	391103a608e23c582ac2f7db131cd203.exe	17
PID 2540 wrote to memory of 2904	2540	391103a608e23c582ac2f7db131cd203.exe	17
PID 2540 wrote to memory of 2904	2540	391103a608e23c582ac2f7db131cd203.exe	17
PID 2540 wrote to memory of 2904	2540	391103a608e23c582ac2f7db131cd203.exe	17
PID 2904 wrote to memory of 2636	2904	Net.exe	16
PID 2904 wrote to memory of 2636	2904	Net.exe	16
PID 2904 wrote to memory of 2636	2904	Net.exe	16
PID 2904 wrote to memory of 2636	2904	Net.exe	16
PID 2904 wrote to memory of 2636	2904	Net.exe	16
PID 2904 wrote to memory of 2636	2904	Net.exe	16
PID 2904 wrote to memory of 2636	2904	Net.exe	16

C:\Users\Admin\AppData\Local\Temp\391103a608e23c582ac2f7db131cd203.exe
"C:\Users\Admin\AppData\Local\Temp\391103a608e23c582ac2f7db131cd203.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\SysWOW64\Net.exe
  Net Stop PcaSvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2904

memory/2540-2-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download