ff5ec2c1351e835e479f1d02f65722274f6d07d26a82ae14d6d01a859b41248a

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
20-03-2024 06:57

Target

d82a5a3a213d381f1a8975148713994e.exe
Size

489KB
MD5

d82a5a3a213d381f1a8975148713994e
SHA1

0bd310364b8ab6b44bfe8624505592a8f1d0e1d5
SHA256

ff5ec2c1351e835e479f1d02f65722274f6d07d26a82ae14d6d01a859b41248a
SHA512

3bbd4697db01fcf5cae99e574a5d3f0f089dee8a18fd64fe41441bb8cce65f95f8f5c60432dd99b34d27ed9b452f30e10079b76caa3d38214980ee45df98988b
SSDEEP

12288:wAEGG7mC+J8x2JM/TlxUYUvilkw1lToXQlfoDGxq92h3kcdOdALZ4:0tz0K2JM/ThUvo1lToXEADJ03rd6AL+

Score

1^/10

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3524	d82a5a3a213d381f1a8975148713994e.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 1696	3524	d82a5a3a213d381f1a8975148713994e.exe	95
PID 3524 wrote to memory of 1696	3524	d82a5a3a213d381f1a8975148713994e.exe	95
PID 3524 wrote to memory of 1696	3524	d82a5a3a213d381f1a8975148713994e.exe	95

C:\Users\Admin\AppData\Local\Temp\d82a5a3a213d381f1a8975148713994e.exe
"C:\Users\Admin\AppData\Local\Temp\d82a5a3a213d381f1a8975148713994e.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Users\Admin\AppData\Local\Temp\d82a5a3a213d381f1a8975148713994e.exe
  "C:\Users\Admin\AppData\Local\Temp\d82a5a3a213d381f1a8975148713994e.exe"
  2⤵
  PID:1696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2264,i,1475924722205134884,16549311107360026087,262144 --variations-seed-version /prefetch:8
1⤵
PID:3272

memory/3524-0-0x0000000000540000-0x0000000000546000-memory.dmp

Filesize
24KB

Download
memory/3524-1-0x00000000010F0000-0x00000000010F2000-memory.dmp

Filesize
8KB

Download