744fd1c5e645134e969cffe71ba9ac7baefee1b2ce80cdf16b35db15d0d69514

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 19:32

Target

我爱记牌器/我爱记牌器.exe
Size

222KB
MD5

594f54e80b61518c2318d85f8d4f706c
SHA1

d4c49de5a90d37ba29fb694408f27457cfff30b5
SHA256

c6fad6d57c66d05f27e39aabfbe0c888990bf454c5b4dc0c4e73633c84b272c9
SHA512

9ecd30336f61531d3d6c198fc111290d6a7c972ba9cb4941f81d09e67b1d79e5d5aa9d2078393e786d345fb700a3da5c509eaafae779b2820a1f006b06d3fa66
SSDEEP

3072:nmM2zwtNZWfxK6pwCOXkaz5HfdilGC02C/0DEWcKKufR9H4CjRvpQEb9fNiLTq:nmtfcutatlKGCzxDxMufR9HLjvb9f1

Score

7^/10

aspackv2

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

resource	yara_rule
behavioral7/memory/1224-0-0x0000000000400000-0x00000000004A7DF0-memory.dmp	aspack_v212_v242
behavioral7/memory/1224-2-0x0000000000400000-0x00000000004A7DF0-memory.dmp	aspack_v212_v242
behavioral7/memory/2272-5-0x0000000000400000-0x00000000004A7DF0-memory.dmp	aspack_v212_v242
behavioral7/memory/2272-6-0x0000000000400000-0x00000000004A7DF0-memory.dmp	aspack_v212_v242
behavioral7/memory/2272-7-0x0000000000400000-0x00000000004A7DF0-memory.dmp	aspack_v212_v242
behavioral7/memory/2272-8-0x0000000000400000-0x00000000004A7DF0-memory.dmp	aspack_v212_v242

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 2272	1224	我爱记牌器.exe	28
PID 1224 wrote to memory of 2272	1224	我爱记牌器.exe	28
PID 1224 wrote to memory of 2272	1224	我爱记牌器.exe	28
PID 1224 wrote to memory of 2272	1224	我爱记牌器.exe	28
PID 1224 wrote to memory of 2272	1224	我爱记牌器.exe	28
PID 1224 wrote to memory of 2272	1224	我爱记牌器.exe	28

C:\Users\Admin\AppData\Local\Temp\我爱记牌器\我爱记牌器.exe
"C:\Users\Admin\AppData\Local\Temp\我爱记牌器\我爱记牌器.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Users\Admin\AppData\Local\Temp\我爱记牌器\我爱记牌器.exe
  "C:\Users\Admin\AppData\Local\Temp\我爱记牌器\我爱记牌器.exe"
  2⤵
  PID:2272

memory/1224-0-0x0000000000400000-0x00000000004A7DF0-memory.dmp

Filesize
671KB

Download
memory/1224-3-0x0000000000497000-0x00000000004A1000-memory.dmp

Filesize
40KB

Download
memory/1224-2-0x0000000000400000-0x00000000004A7DF0-memory.dmp

Filesize
671KB

Download
memory/1224-4-0x0000000001E60000-0x0000000001F08000-memory.dmp

Filesize
672KB

Download
memory/2272-5-0x0000000000400000-0x00000000004A7DF0-memory.dmp

Filesize
671KB

Download
memory/2272-6-0x0000000000400000-0x00000000004A7DF0-memory.dmp

Filesize
671KB

Download
memory/2272-7-0x0000000000400000-0x00000000004A7DF0-memory.dmp

Filesize
671KB

Download
memory/2272-8-0x0000000000400000-0x00000000004A7DF0-memory.dmp

Filesize
671KB

Download