05734ef9f2a2f5293fb875b8555c59c046d3ff1b6b48b9f2538b02c485cdc02e

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 01:49

Target

0aa3281e2106676f80a48bd056d3ecdf.exe
Size

593KB
MD5

0aa3281e2106676f80a48bd056d3ecdf
SHA1

32a213643547a74bd220fb2279152a4d6a0f5d49
SHA256

05734ef9f2a2f5293fb875b8555c59c046d3ff1b6b48b9f2538b02c485cdc02e
SHA512

450013d9351bf579b3e215448e176e7d07295405ca6bd8a547e0a02ec968d8b00d5959f258adfbeab1bdf2b476392afd39b7e2dc8f7e569c9c23ed9a1eb85e0c
SSDEEP

12288:WL1dNZVFsbATyU4RvkWh8mW/MM1aWXU0nnn6lqIT:W1jFKt3RvkWhFsltRIT

Score

1^/10

Suspicious use of UnmapMainImage 3 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 1984	1592	0aa3281e2106676f80a48bd056d3ecdf.exe	29
PID 1592 wrote to memory of 1984	1592	0aa3281e2106676f80a48bd056d3ecdf.exe	29
PID 1592 wrote to memory of 1984	1592	0aa3281e2106676f80a48bd056d3ecdf.exe	29
PID 1592 wrote to memory of 1984	1592	0aa3281e2106676f80a48bd056d3ecdf.exe	29
PID 1592 wrote to memory of 1432	1592	0aa3281e2106676f80a48bd056d3ecdf.exe	28
PID 1592 wrote to memory of 1432	1592	0aa3281e2106676f80a48bd056d3ecdf.exe	28
PID 1592 wrote to memory of 1432	1592	0aa3281e2106676f80a48bd056d3ecdf.exe	28
PID 1592 wrote to memory of 1432	1592	0aa3281e2106676f80a48bd056d3ecdf.exe	28

C:\Users\Admin\AppData\Local\Temp\0aa3281e2106676f80a48bd056d3ecdf.exe
"C:\Users\Admin\AppData\Local\Temp\0aa3281e2106676f80a48bd056d3ecdf.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Users\Admin\AppData\Local\Temp\0aa3281e2106676f80a48bd056d3ecdf.exe
  watch
  2⤵
  - Suspicious use of UnmapMainImage
  PID:1432
- C:\Users\Admin\AppData\Local\Temp\0aa3281e2106676f80a48bd056d3ecdf.exe
  start
  2⤵
  - Suspicious use of UnmapMainImage
  PID:1984

memory/1432-4-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1432-6-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1592-0-0x0000000000230000-0x000000000024F000-memory.dmp

Filesize
124KB

Download
memory/1592-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1592-2-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1984-3-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1984-5-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download