ab0607bc56f4f2ecbf020a610aefb52d4899445a4a204ade06a5c8e34c13bd61

Analysis

max time kernel
40s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 13:41

Target

ab0607bc56f4f2ecbf020a610aefb52d4899445a4a204ade06a5c8e34c13bd61.exe
Size

528KB
MD5

120ec274a9dd73a021302962ec466d7a
SHA1

c414da15aa9a2b0953bdf8c399b93a5b7798f06e
SHA256

ab0607bc56f4f2ecbf020a610aefb52d4899445a4a204ade06a5c8e34c13bd61
SHA512

b868887b1e02755ac5606f0a004dfbe351a1b3b3c42c5e350e4279ab36421aa948ba9b62d819274c28b338f36478bb70c600b507a9b52b39785caec7deafaea0
SSDEEP

12288:Ckv/s8r200pYbs+rxwbf7Nz0wh2DhqpnAToZgQmjg:CuDr70pYbflaDNz0wS8gQmU

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 2028	1648	ab0607bc56f4f2ecbf020a610aefb52d4899445a4a204ade06a5c8e34c13bd61.exe	28
PID 1648 wrote to memory of 2028	1648	ab0607bc56f4f2ecbf020a610aefb52d4899445a4a204ade06a5c8e34c13bd61.exe	28
PID 1648 wrote to memory of 2028	1648	ab0607bc56f4f2ecbf020a610aefb52d4899445a4a204ade06a5c8e34c13bd61.exe	28
PID 1648 wrote to memory of 2028	1648	ab0607bc56f4f2ecbf020a610aefb52d4899445a4a204ade06a5c8e34c13bd61.exe	28

C:\Users\Admin\AppData\Local\Temp\ab0607bc56f4f2ecbf020a610aefb52d4899445a4a204ade06a5c8e34c13bd61.exe
"C:\Users\Admin\AppData\Local\Temp\ab0607bc56f4f2ecbf020a610aefb52d4899445a4a204ade06a5c8e34c13bd61.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Users\Admin\AppData\Local\Temp\ab0607bc56f4f2ecbf020a610aefb52d4899445a4a204ade06a5c8e34c13bd61.exe
  tear
  2⤵
  PID:2028

memory/1648-54-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download
memory/1648-57-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2028-58-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2028-59-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download