d1fbe2fa868d0f9cae9579cbd9f75a324955de6a7458e692b318c19dddea4b15

Analysis

max time kernel
129s
max time network
143s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 04:49

Target

d1fbe2fa868d0f9cae9579cbd9f75a324955de6a7458e692b318c19dddea4b15.exe
Size

130KB
MD5

224d101467cffc0981102708e3e6c3d0
SHA1

484f58635cfbf01c82e40bed9a798dc009889ed7
SHA256

d1fbe2fa868d0f9cae9579cbd9f75a324955de6a7458e692b318c19dddea4b15
SHA512

10a8be61118a46ea910b7e7d5913d1b4ef90b07bad8a8da0510de595229768fe03c73d7526e8a9ac88271d62494a4f4fefc3dea11823fcd6e87c6ed62a508255
SSDEEP

3072:I3N8m6Kt/lL2jpNu1nLX9ljjjjjjjjjcSxm85yi7JR:ytwju1nLFxm8

Score

1^/10

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1696	d1fbe2fa868d0f9cae9579cbd9f75a324955de6a7458e692b318c19dddea4b15.exe
1696	d1fbe2fa868d0f9cae9579cbd9f75a324955de6a7458e692b318c19dddea4b15.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1696	d1fbe2fa868d0f9cae9579cbd9f75a324955de6a7458e692b318c19dddea4b15.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 980	1696	d1fbe2fa868d0f9cae9579cbd9f75a324955de6a7458e692b318c19dddea4b15.exe	27
PID 1696 wrote to memory of 980	1696	d1fbe2fa868d0f9cae9579cbd9f75a324955de6a7458e692b318c19dddea4b15.exe	27
PID 1696 wrote to memory of 980	1696	d1fbe2fa868d0f9cae9579cbd9f75a324955de6a7458e692b318c19dddea4b15.exe	27
PID 1696 wrote to memory of 980	1696	d1fbe2fa868d0f9cae9579cbd9f75a324955de6a7458e692b318c19dddea4b15.exe	27
PID 1696 wrote to memory of 980	1696	d1fbe2fa868d0f9cae9579cbd9f75a324955de6a7458e692b318c19dddea4b15.exe	27
PID 1696 wrote to memory of 980	1696	d1fbe2fa868d0f9cae9579cbd9f75a324955de6a7458e692b318c19dddea4b15.exe	27
PID 1696 wrote to memory of 980	1696	d1fbe2fa868d0f9cae9579cbd9f75a324955de6a7458e692b318c19dddea4b15.exe	27

memory/980-58-0x00000000004F0000-0x00000000004F8000-memory.dmp

Filesize
32KB

Download
memory/980-59-0x00000000000D0000-0x00000000000E1000-memory.dmp

Filesize
68KB

Download
memory/980-60-0x00000000002B0000-0x0000000000330000-memory.dmp

Filesize
512KB

Download
memory/1696-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/1696-57-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download