3afa2f6a6fa28303c9fd4bc4f9c6f5c7ba36c0c58a8d161c106228a919d2d8ed

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-03-2024 20:34

Target

e249c3cf931a39ce861670aca977b737.exe
Size

234KB
MD5

e249c3cf931a39ce861670aca977b737
SHA1

254f502d0e9709f95bbe045a4516afef612ce9e7
SHA256

3afa2f6a6fa28303c9fd4bc4f9c6f5c7ba36c0c58a8d161c106228a919d2d8ed
SHA512

38baf042bf700a2f01dda7b56bcdf4ac11a413f21c90d55308535dd11c6e88a20c7e80d7a1a85ee35bff47a8fb458c81c0bd60ba465a02fe800f155b33b215a1
SSDEEP

6144:x9P+k59oF8WaZbzbFXKSh1KGhDwoNzgc/P/97gPiS:x8k9DWaZpXL1KWDwdId6V

Score

1^/10

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

e249c3cf931a39ce861670aca977b737.exe

pid process

1612 e249c3cf931a39ce861670aca977b737.exe

pid	process
1612	e249c3cf931a39ce861670aca977b737.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

e249c3cf931a39ce861670aca977b737.exe

description	pid	process	target process
PID 1612 wrote to memory of 2012	1612	e249c3cf931a39ce861670aca977b737.exe	MSBuild.exe
PID 1612 wrote to memory of 2012	1612	e249c3cf931a39ce861670aca977b737.exe	MSBuild.exe
PID 1612 wrote to memory of 2012	1612	e249c3cf931a39ce861670aca977b737.exe	MSBuild.exe
PID 1612 wrote to memory of 2012	1612	e249c3cf931a39ce861670aca977b737.exe	MSBuild.exe
PID 1612 wrote to memory of 2012	1612	e249c3cf931a39ce861670aca977b737.exe	MSBuild.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Users\Admin\AppData\Local\Temp\e249c3cf931a39ce861670aca977b737.exe"
2⤵
PID:2012

memory/1612-1-0x0000000000090000-0x0000000000190000-memory.dmp

Filesize
1024KB

Download
memory/1612-2-0x00000000001C0000-0x00000000001C2000-memory.dmp

Filesize
8KB

Download