4202f7fb5710bdb128f6619b2f441cca74c2637267cb1a37b955d7563522ac1b

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-01-2025 01:06

Target

Adag_Quotation_2025-1-14.exe
Size

51KB
MD5

a2e9a84eae8e9aaa4bb868bb66f49ce0
SHA1

f07429c1bc59a2635ac4643482f5e4fd9cbec8ca
SHA256

e4dbe778ab4b0e7df0897c648caf862ed25d15287754c90533ec755a6629e71b
SHA512

dfe534cad23933d9335d8d196a4e215916d2579986222cb4b45b7b88eba3ea6f908750f06c33f7fe9c6337b125ea0408019c2324ca5360e3baacc02a67e919d6
SSDEEP

768:essD+DOMB/IhjWxz8bUDGt9l20Gu/aG9yGON3PKILYijFUs3h+q:ej89GSob7vY0Gu/cV/L7Zv3h+q

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2188	2124	Adag_Quotation_2025-1-14.exe	31
PID 2124 wrote to memory of 2188	2124	Adag_Quotation_2025-1-14.exe	31
PID 2124 wrote to memory of 2188	2124	Adag_Quotation_2025-1-14.exe	31
PID 2124 wrote to memory of 2188	2124	Adag_Quotation_2025-1-14.exe	31

C:\Users\Admin\AppData\Local\Temp\Adag_Quotation_2025-1-14.exe
"C:\Users\Admin\AppData\Local\Temp\Adag_Quotation_2025-1-14.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:2188