c1d52a5d83b3f1660b9ecdb1ad26fb3b7edc7f02bcec4dd320e237a62c433d07

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-04-2024 16:13

Target

JHW09000900.exe
Size

656KB
MD5

54dc35ab78394f31963d2f0bd30a6b7b
SHA1

4904138a54baf5cb440933e502ff6e8cb6b00829
SHA256

ec45a354ba2c7cba3c064325f968d62cdb3999122b76080dd145cc49f13bf7e7
SHA512

c54d2abf270dd31eb9e3bf44762803f3d1e4d41a6ea43fd37003a64983fddbac5545a5dafe15b3224aadb7f25037c8dc8818480210a30ef6ed69fef326895d7b
SSDEEP

12288:lrf0P3HD5Y2fxOZAcLlQuhntyyFgF1/OV0b4R7wZSEleGxCRfdbBKqS/XWsHFsdn:2P3H1Y2f4HLVnILvOV0b4R7ASEleGmft

Score

1^/10

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2304	JHW09000900.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2408	2304	JHW09000900.exe	28
PID 2304 wrote to memory of 2408	2304	JHW09000900.exe	28
PID 2304 wrote to memory of 2408	2304	JHW09000900.exe	28
PID 2304 wrote to memory of 2408	2304	JHW09000900.exe	28
PID 2304 wrote to memory of 2408	2304	JHW09000900.exe	28

C:\Users\Admin\AppData\Local\Temp\JHW09000900.exe
"C:\Users\Admin\AppData\Local\Temp\JHW09000900.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Users\Admin\AppData\Local\Temp\JHW09000900.exe"
  2⤵
  PID:2408

memory/2304-0-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2304-1-0x0000000000230000-0x0000000000232000-memory.dmp

Filesize
8KB

Download
memory/2304-2-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download