e135385603e2df5429b326841d4755f9edc6bcd86450f04d284dc45ea621c56c

Analysis

max time kernel
122s
max time network
157s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 03:02

Target

4ea950fc894a846d1a68931b149c2802.exe
Size

342KB
MD5

4ea950fc894a846d1a68931b149c2802
SHA1

88f7997ad608ecda14e0af5594d89d418ec38808
SHA256

e135385603e2df5429b326841d4755f9edc6bcd86450f04d284dc45ea621c56c
SHA512

950c7a7d85f2af7b48909934454e8b8ff5f05f3c5543261fc70f0361c37c5d48af973c0e1eacc1e466ab1ced12b4a61bfbc690870895715d0c89bb8ff1b49b1b
SSDEEP

6144:CZGh9F7ZmKBcgqh3SBuvXUW64ROVlYpvvnEHrCZyp/zpXW5mq6ExGNElnzGWwXFf:CZG1dmKO0SE+OnY5sHrCZ2zZW4qrxPlC

Score

1^/10

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

4ea950fc894a846d1a68931b149c2802.exe

pid process

1116 4ea950fc894a846d1a68931b149c2802.exe

pid	process
1116	4ea950fc894a846d1a68931b149c2802.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

4ea950fc894a846d1a68931b149c2802.exe

description	pid	process	target process
PID 1116 wrote to memory of 2956	1116	4ea950fc894a846d1a68931b149c2802.exe	MSBuild.exe
PID 1116 wrote to memory of 2956	1116	4ea950fc894a846d1a68931b149c2802.exe	MSBuild.exe
PID 1116 wrote to memory of 2956	1116	4ea950fc894a846d1a68931b149c2802.exe	MSBuild.exe
PID 1116 wrote to memory of 2956	1116	4ea950fc894a846d1a68931b149c2802.exe	MSBuild.exe
PID 1116 wrote to memory of 2956	1116	4ea950fc894a846d1a68931b149c2802.exe	MSBuild.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Users\Admin\AppData\Local\Temp\4ea950fc894a846d1a68931b149c2802.exe"
2⤵
PID:2956

memory/1116-1-0x0000000000090000-0x0000000000190000-memory.dmp

Filesize
1024KB

Download
memory/1116-2-0x0000000000300000-0x0000000000302000-memory.dmp

Filesize
8KB

Download