d76f2f5bd46716639a5e0cb629bb99ff572d554896ca1abc198ba9deb1bdd116

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-03-2024 02:31

Target

d7a8d38fe5070399f64dd2e2a1bbf584.exe
Size

225KB
MD5

d7a8d38fe5070399f64dd2e2a1bbf584
SHA1

7f7597e2e71088f3aaa80019fb44f440180a8d1a
SHA256

d76f2f5bd46716639a5e0cb629bb99ff572d554896ca1abc198ba9deb1bdd116
SHA512

681ca2e09babe428301ac0d99d762cce9a5281d97b87e30350e1f5802ec89246eb63287b8be812d2e4d3dd4c5db50f294ea21533ac507ab5babe8f6330e8ee04
SSDEEP

6144:qmlmOTa6Qw3eQWpk9GS0fr92wCxShmVuYYSX2VZ8Casx:vkOTQdkifr9qQyJjXXsx

Score

1^/10

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1008	d7a8d38fe5070399f64dd2e2a1bbf584.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 2920	1008	d7a8d38fe5070399f64dd2e2a1bbf584.exe	29
PID 1008 wrote to memory of 2920	1008	d7a8d38fe5070399f64dd2e2a1bbf584.exe	29
PID 1008 wrote to memory of 2920	1008	d7a8d38fe5070399f64dd2e2a1bbf584.exe	29
PID 1008 wrote to memory of 2920	1008	d7a8d38fe5070399f64dd2e2a1bbf584.exe	29
PID 1008 wrote to memory of 2920	1008	d7a8d38fe5070399f64dd2e2a1bbf584.exe	29

C:\Users\Admin\AppData\Local\Temp\d7a8d38fe5070399f64dd2e2a1bbf584.exe
"C:\Users\Admin\AppData\Local\Temp\d7a8d38fe5070399f64dd2e2a1bbf584.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Users\Admin\AppData\Local\Temp\d7a8d38fe5070399f64dd2e2a1bbf584.exe"
  2⤵
  PID:2920

memory/1008-0-0x0000000000BA0000-0x0000000000BA6000-memory.dmp

Filesize
24KB

Download
memory/1008-1-0x00000000001C0000-0x00000000001C2000-memory.dmp

Filesize
8KB

Download