71319a67df80230e1b2c80b0d38a385f165db1688e17ac6e7897d330bc55461a

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 11:45

Target

agas.exe
Size

678KB
MD5

6f222b7903bb6198d413030befe12940
SHA1

04164a4058132fac9e144df3128ab3f660cb4245
SHA256

71319a67df80230e1b2c80b0d38a385f165db1688e17ac6e7897d330bc55461a
SHA512

025f119715f73ae3be765db15e942a9811e260949598e813e5f4bd71506588d15eb206aa0890cfab4d6f643e039dc220f21eba27864797cfc07b12ce2a6acdd2
SSDEEP

12288:orrEBo7lhHfN6zQO8h6GQnQqzdL4qjjIY5ewA:oXz7lhl6kv0nQqzBJj8dwA

Score

1^/10

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 3052	2224	agas.exe	29
PID 2224 wrote to memory of 3052	2224	agas.exe	29
PID 2224 wrote to memory of 3052	2224	agas.exe	29
PID 3052 wrote to memory of 2504	3052	cmd.exe	30
PID 3052 wrote to memory of 2504	3052	cmd.exe	30
PID 3052 wrote to memory of 2504	3052	cmd.exe	30
PID 3052 wrote to memory of 2000	3052	cmd.exe	31
PID 3052 wrote to memory of 2000	3052	cmd.exe	31
PID 3052 wrote to memory of 2000	3052	cmd.exe	31
PID 3052 wrote to memory of 3044	3052	cmd.exe	32
PID 3052 wrote to memory of 3044	3052	cmd.exe	32
PID 3052 wrote to memory of 3044	3052	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\agas.exe
"C:\Users\Admin\AppData\Local\Temp\agas.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\agas.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\agas.exe" MD5
    3⤵
    PID:2504
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:2000
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:3044