e6407a39f1b2fb728a40612d6ca8e71d6dc004d9efb569f2f4d351ab693ac6f4

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05-01-2024 23:59

Target

44c401c50cdbecf5f20fffd60e48628f.exe
Size

299KB
MD5

44c401c50cdbecf5f20fffd60e48628f
SHA1

6ba74f52e4e774f5762e99d7f49cc787f28353d4
SHA256

e6407a39f1b2fb728a40612d6ca8e71d6dc004d9efb569f2f4d351ab693ac6f4
SHA512

ae385fe48068210b45075d1b2433bb3606766f2e6fc17d9c14582040f2f2b64f411e1bcd29facc16fa59243987d894c7a084a573db032909e68a8d977d5108f3
SSDEEP

6144:LWlg4qQdWyIAvEZ023cZ05Pi+xPwIwWFvAKbmWJI8xF7+Or:LQzAyIAvP7iwWyKb1+GqOr

Score

1^/10

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2908	44c401c50cdbecf5f20fffd60e48628f.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2252	2908	44c401c50cdbecf5f20fffd60e48628f.exe	28
PID 2908 wrote to memory of 2252	2908	44c401c50cdbecf5f20fffd60e48628f.exe	28
PID 2908 wrote to memory of 2252	2908	44c401c50cdbecf5f20fffd60e48628f.exe	28
PID 2908 wrote to memory of 2252	2908	44c401c50cdbecf5f20fffd60e48628f.exe	28

C:\Users\Admin\AppData\Local\Temp\44c401c50cdbecf5f20fffd60e48628f.exe
"C:\Users\Admin\AppData\Local\Temp\44c401c50cdbecf5f20fffd60e48628f.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Users\Admin\AppData\Local\Temp\44c401c50cdbecf5f20fffd60e48628f.exe
  "C:\Users\Admin\AppData\Local\Temp\44c401c50cdbecf5f20fffd60e48628f.exe"
  2⤵
  PID:2252

memory/2908-0-0x00000000001B0000-0x00000000001C9000-memory.dmp

Filesize
100KB

Download
memory/2908-1-0x0000000000140000-0x0000000000142000-memory.dmp

Filesize
8KB

Download
memory/2908-2-0x00000000001B0000-0x00000000001C9000-memory.dmp

Filesize
100KB

Download