28fe91c48fa8583da9692cbdee3c2c32038d5dc3f8ca7dcd195f74511c1d6a78

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 06:09

Target

96739a4d394217c2cbd895cf16acc0c8.exe
Size

455KB
MD5

96739a4d394217c2cbd895cf16acc0c8
SHA1

90af83fed1eb2652e133aad4f47f9354287f75a8
SHA256

28fe91c48fa8583da9692cbdee3c2c32038d5dc3f8ca7dcd195f74511c1d6a78
SHA512

846383b8cd6ff5208c96bf2063faff5c2fa1c1d5d714c11cb30d9aa84ad56f2435f70b2446cfc7006920a4b71dfc568bb36e03d5e8d077db757e673307729955
SSDEEP

6144:FpJ+LBFdhgY3AgXUU6EEsgg/nzzYjzZnMUzpVltygvxTUpVP/KW+q9UT95GX:vArdGPqSENgg/KRpT/vxUpMLR5k

Score

1^/10

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

96739a4d394217c2cbd895cf16acc0c8.exe

pid process

2000 96739a4d394217c2cbd895cf16acc0c8.exe

pid	process
2000	96739a4d394217c2cbd895cf16acc0c8.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

96739a4d394217c2cbd895cf16acc0c8.exe

description	pid	process	target process
PID 2000 wrote to memory of 1900	2000	96739a4d394217c2cbd895cf16acc0c8.exe	96739a4d394217c2cbd895cf16acc0c8.exe
PID 2000 wrote to memory of 1900	2000	96739a4d394217c2cbd895cf16acc0c8.exe	96739a4d394217c2cbd895cf16acc0c8.exe
PID 2000 wrote to memory of 1900	2000	96739a4d394217c2cbd895cf16acc0c8.exe	96739a4d394217c2cbd895cf16acc0c8.exe
PID 2000 wrote to memory of 1900	2000	96739a4d394217c2cbd895cf16acc0c8.exe	96739a4d394217c2cbd895cf16acc0c8.exe

C:\Users\Admin\AppData\Local\Temp\96739a4d394217c2cbd895cf16acc0c8.exe
"C:\Users\Admin\AppData\Local\Temp\96739a4d394217c2cbd895cf16acc0c8.exe"
2⤵
PID:1900

memory/2000-0-0x00000000000A0000-0x00000000000E0000-memory.dmp

Filesize
256KB

Download
memory/2000-2-0x00000000000A0000-0x00000000000E0000-memory.dmp

Filesize
256KB

Download
memory/2000-1-0x0000000000080000-0x0000000000082000-memory.dmp

Filesize
8KB

Download