AppData file write leads to an observed child process
A report connects a small .NET input to a distinct executable written under AppData and launched as its child, with a temporary-path process beneath it. An executable download request offers a possible delivery lead, but the records do not show that the request supplied the launched file.
A sandbox report places an executable under %APPDATA% and shows a process at that same path as a child of the file being tested. The input is a .NET program just 7,168 bytes long. Is that small executable the program investigators need to understand, or is its more consequential role to start something else? The records assembled by CTX Threat Intelligence support the second reading: the sample participates in a concrete handoff to another executable, which in turn has a temporary-file process…
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read