3f4bd5a93aa0607d84a40bff42ffb335e2409b01d38de5224baa44f9c497d3fa

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-01-2024 00:31

Target

3b754cf1cf87440ab8c206367bb500e7.exe
Size

2.6MB
MD5

3b754cf1cf87440ab8c206367bb500e7
SHA1

e0e9d19e11c1611b12f7aef87e565a46035452b8
SHA256

3f4bd5a93aa0607d84a40bff42ffb335e2409b01d38de5224baa44f9c497d3fa
SHA512

c16c90287c1a79088a57559bbff2fa80af7fb2d405605f3832880c652695602276529e5c5e5e8992fdda387e899924971261b9c876b0070698e546ad4f4672ce
SSDEEP

49152:ylY613yTNIsKtZBYFRISOWaTz41/iqCL5D2kudRmWjSG8k5zes:ylVZBc2T+aqClQRmW2I6s

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2344	2356	3b754cf1cf87440ab8c206367bb500e7.exe	19
PID 2356 wrote to memory of 2344	2356	3b754cf1cf87440ab8c206367bb500e7.exe	19
PID 2356 wrote to memory of 2344	2356	3b754cf1cf87440ab8c206367bb500e7.exe	19
PID 2356 wrote to memory of 2344	2356	3b754cf1cf87440ab8c206367bb500e7.exe	19
PID 2356 wrote to memory of 2344	2356	3b754cf1cf87440ab8c206367bb500e7.exe	19
PID 2356 wrote to memory of 2344	2356	3b754cf1cf87440ab8c206367bb500e7.exe	19
PID 2356 wrote to memory of 2344	2356	3b754cf1cf87440ab8c206367bb500e7.exe	19
PID 2344 wrote to memory of 2864	2344	Net.exe	17
PID 2344 wrote to memory of 2864	2344	Net.exe	17
PID 2344 wrote to memory of 2864	2344	Net.exe	17
PID 2344 wrote to memory of 2864	2344	Net.exe	17
PID 2344 wrote to memory of 2864	2344	Net.exe	17
PID 2344 wrote to memory of 2864	2344	Net.exe	17
PID 2344 wrote to memory of 2864	2344	Net.exe	17

C:\Users\Admin\AppData\Local\Temp\3b754cf1cf87440ab8c206367bb500e7.exe
"C:\Users\Admin\AppData\Local\Temp\3b754cf1cf87440ab8c206367bb500e7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\SysWOW64\Net.exe
  Net Stop PcaSvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2344

memory/2356-6-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download