afe33a2461331c3bdcf2dd06d1399aca5420d812a68adc092d269e7dfc9148ef

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 17:37

Target

astro injector.exe
Size

26KB
MD5

45988c9de2a6bf18a42638d33a57fac9
SHA1

effbbc98b7bec2df40faeb8bab5428fb20624293
SHA256

708095f325623bf03f0fad5f3372be8766fd89e9dffdd0f2cba173e0bfa970dc
SHA512

a4d461f40455c036f69b7a5212d1c757d2f20fd91515bd17a4415ef3c16ebc9be334ac4f5f74d3ad320ae55404a7d6bac239ce3f4ceebd7dc8c0101e8219e54e
SSDEEP

384:W4BpWH9PsHqrD/zTjYfJ53rri0sNn4mPmCFW/ae1a/pEX+QIZkCtyazNKcIL0S06:zvbAD/zXuZMn4ofFW/hEqaZKcI

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2092	astro injector.exe
2092	astro injector.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2788	2092	astro injector.exe	31
PID 2092 wrote to memory of 2788	2092	astro injector.exe	31
PID 2092 wrote to memory of 2788	2092	astro injector.exe	31

C:\Users\Admin\AppData\Local\Temp\astro injector.exe
"C:\Users\Admin\AppData\Local\Temp\astro injector.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start steam://rungameid/2524890
  2⤵
  PID:2788

memory/2788-10-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download