b5928522e23bac0c8caf5bc9a700bdf78d4be8f61aaeeb9589e6c1f72c2d68b1

Analysis

max time kernel
31s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:07

Target

b5928522e23bac0c8caf5bc9a700bdf78d4be8f61aaeeb9589e6c1f72c2d68b1.exe
Size

527KB
MD5

4991db55d398816ed39e4018185d1f32
SHA1

49d6b17075acf40ca7c6099f477af2a29cefa8d9
SHA256

b5928522e23bac0c8caf5bc9a700bdf78d4be8f61aaeeb9589e6c1f72c2d68b1
SHA512

753aac60ff03ec45fa8fbb87461bf652846191f970b446badaa699c3332767c75bf5405c810ff6b21848b0abc2d3ec270744a461c1e3cda3d070636ced21da1f
SSDEEP

6144:D5dxOwfHJAiow5y94gwphO365BkSVaEP0Mb9Ycwt1aARJ3++smbC8F51yRAo/iR6:D5ntfHJ1Y3Wfnq1Hqsl1yZ/+d8VsWx

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

b5928522e23bac0c8caf5bc9a700bdf78d4be8f61aaeeb9589e6c1f72c2d68b1.exe

description	pid	process	target process
PID 2000 wrote to memory of 1984	2000	b5928522e23bac0c8caf5bc9a700bdf78d4be8f61aaeeb9589e6c1f72c2d68b1.exe	b5928522e23bac0c8caf5bc9a700bdf78d4be8f61aaeeb9589e6c1f72c2d68b1.exe
PID 2000 wrote to memory of 1984	2000	b5928522e23bac0c8caf5bc9a700bdf78d4be8f61aaeeb9589e6c1f72c2d68b1.exe	b5928522e23bac0c8caf5bc9a700bdf78d4be8f61aaeeb9589e6c1f72c2d68b1.exe
PID 2000 wrote to memory of 1984	2000	b5928522e23bac0c8caf5bc9a700bdf78d4be8f61aaeeb9589e6c1f72c2d68b1.exe	b5928522e23bac0c8caf5bc9a700bdf78d4be8f61aaeeb9589e6c1f72c2d68b1.exe
PID 2000 wrote to memory of 1984	2000	b5928522e23bac0c8caf5bc9a700bdf78d4be8f61aaeeb9589e6c1f72c2d68b1.exe	b5928522e23bac0c8caf5bc9a700bdf78d4be8f61aaeeb9589e6c1f72c2d68b1.exe

C:\Users\Admin\AppData\Local\Temp\b5928522e23bac0c8caf5bc9a700bdf78d4be8f61aaeeb9589e6c1f72c2d68b1.exe
"C:\Users\Admin\AppData\Local\Temp\b5928522e23bac0c8caf5bc9a700bdf78d4be8f61aaeeb9589e6c1f72c2d68b1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2000

C:\Users\Admin\AppData\Local\Temp\b5928522e23bac0c8caf5bc9a700bdf78d4be8f61aaeeb9589e6c1f72c2d68b1.exe
tear
2⤵
PID:1984

memory/1984-55-0x0000000000000000-mapping.dmp

Download
memory/1984-58-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1984-59-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2000-54-0x00000000754E1000-0x00000000754E3000-memory.dmp

Filesize
8KB

Download
memory/2000-56-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download