48c413dc3e7f0e874d5a8f01bdfee4adecc4de345dcd6ec816a91d4d8d5c57aa

Analysis

max time kernel
46s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 05:55

Target

48c413dc3e7f0e874d5a8f01bdfee4adecc4de345dcd6ec816a91d4d8d5c57aa.exe
Size

73KB
MD5

43104afe7f185afc9963ba0dd0cc1420
SHA1

1b642b1b313dfabeda8c9a47109cfc3880387ea0
SHA256

48c413dc3e7f0e874d5a8f01bdfee4adecc4de345dcd6ec816a91d4d8d5c57aa
SHA512

a0963913879826a18f0ff172d6381395468b415dfff0c1afbc0c52c607d2ee93148dc28394cd41ff6ee4c2b970bd48951e6c1401e156925ff0693e52ca604d85
SSDEEP

1536:HbSYv9ZK5QPqfhVWbdsmA+RjPFLC+e5hT0ZGUGf2g:HGYvHNPqfcxA+HFshTOg

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1968	1720	48c413dc3e7f0e874d5a8f01bdfee4adecc4de345dcd6ec816a91d4d8d5c57aa.exe	28
PID 1720 wrote to memory of 1968	1720	48c413dc3e7f0e874d5a8f01bdfee4adecc4de345dcd6ec816a91d4d8d5c57aa.exe	28
PID 1720 wrote to memory of 1968	1720	48c413dc3e7f0e874d5a8f01bdfee4adecc4de345dcd6ec816a91d4d8d5c57aa.exe	28
PID 1720 wrote to memory of 1968	1720	48c413dc3e7f0e874d5a8f01bdfee4adecc4de345dcd6ec816a91d4d8d5c57aa.exe	28

C:\Users\Admin\AppData\Local\Temp\48c413dc3e7f0e874d5a8f01bdfee4adecc4de345dcd6ec816a91d4d8d5c57aa.exe
"C:\Users\Admin\AppData\Local\Temp\48c413dc3e7f0e874d5a8f01bdfee4adecc4de345dcd6ec816a91d4d8d5c57aa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c 00.exe
  2⤵
  PID:1968