ea8e830aee3ca762fa8d37597994acf261430d0ec3f393b1861e6e9d7ac3c552

Analysis

max time kernel
138s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/02/2024, 21:30 UTC

Target

XSpammer.exe
Size

125.0MB
MD5

123d82725f2fe084f2df4c7c12265777
SHA1

94bd38f170fe619777b5eb8cb2e1978ccc6efecf
SHA256

333c92f0ef14c88610341187b4f5ab54f9afe91c767d383e1578d6bc5706b32e
SHA512

10781fd04263d314b7d357e2d756656f643c2416a2de45e413b28dcd3781bd72d9fdf2ce253b4471c4679c314c4cee8f7ee63e7007418b24de96f765b9e143b5
SSDEEP

1572864:8NNR5hJdL+/D6n+Ik9FYHHND5vfgIi9is0COnRaW3gcT:8PMu+IsFY7Z/Nv

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3020	XSpammer.exe
3020	XSpammer.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2152	3020	XSpammer.exe	28
PID 3020 wrote to memory of 2152	3020	XSpammer.exe	28
PID 3020 wrote to memory of 2152	3020	XSpammer.exe	28
PID 3020 wrote to memory of 2152	3020	XSpammer.exe	28
PID 3020 wrote to memory of 2152	3020	XSpammer.exe	28
PID 3020 wrote to memory of 2152	3020	XSpammer.exe	28
PID 3020 wrote to memory of 2152	3020	XSpammer.exe	28
PID 3020 wrote to memory of 2152	3020	XSpammer.exe	28

C:\Users\Admin\AppData\Local\Temp\XSpammer.exe
"C:\Users\Admin\AppData\Local\Temp\XSpammer.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Users\Admin\AppData\Local\Temp\XSpammer.exe
  "C:\Users\Admin\AppData\Local\Temp\XSpammer.exe" --type=gpu-process --field-trial-handle=988,12826651058612806054,2344026911732147720,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1004 /prefetch:2
  2⤵
  PID:2152

memory/2152-1-0x0000000000860000-0x0000000000861000-memory.dmp

Filesize
4KB

Download
memory/3020-21-0x0000000002630000-0x0000000002631000-memory.dmp

Filesize
4KB

Download