7f2220ecfdb74b1024871aeedf0b92b824e274e7adf6c3cf4e1b20d3eb1efb9b

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 20:39

Target

MR-ASH~1.exe
Size

44KB
MD5

a15d0c4e4c97afdb7afc26d169f96f3e
SHA1

61d21b96d2f099451df6e6f0175a5beab9fb7b70
SHA256

29de507f900e97db385c1fdb1e71449d0ae962489c4e1f5ecac001248813a44e
SHA512

a043dc1c7be2df2949335fce6042a96f0a20b6bd011d0ab8aaddb3ad59454d34299cf1c3ca6692dae4ab41759877a8601ed1929ac6dee7c0a970256d705cb6bd
SSDEEP

768:Pxl7DDTBeid/TeiZRVWRBwkXno0L7UTLuSnqUHw:5ltXkXo8UTaSQ

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2528	MR-ASH~1.exe
2528	MR-ASH~1.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 1208	2528	MR-ASH~1.exe	21
PID 2528 wrote to memory of 1208	2528	MR-ASH~1.exe	21
PID 2528 wrote to memory of 1208	2528	MR-ASH~1.exe	21
PID 2528 wrote to memory of 1208	2528	MR-ASH~1.exe	21

memory/1208-1-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1208-5-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/2528-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2528-4-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2528-16-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download