a490f339d059cefd0840b856f39f9f8689db9e34e2bf5582862f533459593312

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 23:09

Target

ad18f3aaaa3921f0c26016f8d004e914.exe
Size

733KB
MD5

ad18f3aaaa3921f0c26016f8d004e914
SHA1

757ab2779c927b5de01512da16defd6c405f88cc
SHA256

a490f339d059cefd0840b856f39f9f8689db9e34e2bf5582862f533459593312
SHA512

8b698b03aa93cb86290b55328a29929bafe68211d39385c08138953ebe2cad336e3fe8760545e2319e615fdc7802687e8adc8c0b35b3950d63327fd7f131edb6
SSDEEP

12288:GQ3dh+p1h79i/DdA1NUyfJjQuAkmQTLlzZjPcAVNHbAoI/1TgHJtCCLE5z:GQNjDdkUyfJttDvbAoI/p4Ji9

Score

1^/10

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3020	ad18f3aaaa3921f0c26016f8d004e914.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2484	3020	ad18f3aaaa3921f0c26016f8d004e914.exe	90
PID 3020 wrote to memory of 2484	3020	ad18f3aaaa3921f0c26016f8d004e914.exe	90
PID 3020 wrote to memory of 2484	3020	ad18f3aaaa3921f0c26016f8d004e914.exe	90

C:\Users\Admin\AppData\Local\Temp\ad18f3aaaa3921f0c26016f8d004e914.exe
"C:\Users\Admin\AppData\Local\Temp\ad18f3aaaa3921f0c26016f8d004e914.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Users\Admin\AppData\Local\Temp\ad18f3aaaa3921f0c26016f8d004e914.exe
  "C:\Users\Admin\AppData\Local\Temp\ad18f3aaaa3921f0c26016f8d004e914.exe"
  2⤵
  PID:2484

memory/3020-0-0x0000000000E50000-0x0000000000ED5000-memory.dmp

Filesize
532KB

Download
memory/3020-1-0x0000000001460000-0x0000000001462000-memory.dmp

Filesize
8KB

Download
memory/3020-2-0x0000000000E50000-0x0000000000ED5000-memory.dmp

Filesize
532KB

Download