131f551bd9f4613a4cbe274d19f0798b58898470c1df1b3d414eb105eab345eb

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 05:58

Target

2aec3c515bf7f627060db5886adfb2c4.exe
Size

589KB
MD5

2aec3c515bf7f627060db5886adfb2c4
SHA1

d554eadd9264c399a3b245effc4d22f7296e55cb
SHA256

131f551bd9f4613a4cbe274d19f0798b58898470c1df1b3d414eb105eab345eb
SHA512

e2137ae5c7e750a4533f803436670e872aa51ea42c9353ffec673e54e822e1ba19a5d64a078735d1c587714eeb586b1e2518ef08d80bba0d0b502dcb374eb47a
SSDEEP

6144:AqGFCwWI7D+inb/5/lG3yPKZmla/q1u2DiG3WCqryzdlAbcn197:AU6vb/NlG3yPpcyu2+02+Ziu

Score

1^/10

Suspicious use of UnmapMainImage 3 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 2236	1400	2aec3c515bf7f627060db5886adfb2c4.exe	28
PID 1400 wrote to memory of 2236	1400	2aec3c515bf7f627060db5886adfb2c4.exe	28
PID 1400 wrote to memory of 2236	1400	2aec3c515bf7f627060db5886adfb2c4.exe	28
PID 1400 wrote to memory of 2236	1400	2aec3c515bf7f627060db5886adfb2c4.exe	28
PID 1400 wrote to memory of 2520	1400	2aec3c515bf7f627060db5886adfb2c4.exe	29
PID 1400 wrote to memory of 2520	1400	2aec3c515bf7f627060db5886adfb2c4.exe	29
PID 1400 wrote to memory of 2520	1400	2aec3c515bf7f627060db5886adfb2c4.exe	29
PID 1400 wrote to memory of 2520	1400	2aec3c515bf7f627060db5886adfb2c4.exe	29

C:\Users\Admin\AppData\Local\Temp\2aec3c515bf7f627060db5886adfb2c4.exe
"C:\Users\Admin\AppData\Local\Temp\2aec3c515bf7f627060db5886adfb2c4.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Users\Admin\AppData\Local\Temp\2aec3c515bf7f627060db5886adfb2c4.exe
  start
  2⤵
  - Suspicious use of UnmapMainImage
  PID:2236
- C:\Users\Admin\AppData\Local\Temp\2aec3c515bf7f627060db5886adfb2c4.exe
  watch
  2⤵
  - Suspicious use of UnmapMainImage
  PID:2520

memory/1400-0-0x000000007EF90000-0x000000007EFAF000-memory.dmp

Filesize
124KB

Download
memory/1400-1-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2236-2-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2236-4-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2520-3-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2520-5-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download