7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b

Analysis

max time kernel
170s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:06

Target

7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe
Size

522KB
MD5

b05512b7b5589e147046a48637174d85
SHA1

c0038fd18cc12fe05c73908662992b53c2b7d2c3
SHA256

7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b
SHA512

e8c852bebf5bc4bfb7cdcfbd85357689f479ef10b42b01b09754e0f5be25294dab35a1f4a896a82ed4ae956a7e42588d34ecdada755f37b6b05f15e9c29cc80d
SSDEEP

12288:soklxRzHPLUFL2cPavjHy18xQqpx8O5c:F+PzHPL+FSvjHatqpx8

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe

description	pid	process	target process
PID 1272 wrote to memory of 4860	1272	7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe	7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe
PID 1272 wrote to memory of 4860	1272	7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe	7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe
PID 1272 wrote to memory of 4860	1272	7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe	7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe
PID 1272 wrote to memory of 2608	1272	7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe	7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe
PID 1272 wrote to memory of 2608	1272	7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe	7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe
PID 1272 wrote to memory of 2608	1272	7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe	7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe

C:\Users\Admin\AppData\Local\Temp\7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe
"C:\Users\Admin\AppData\Local\Temp\7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1272

C:\Users\Admin\AppData\Local\Temp\7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe
start
2⤵
PID:4860

C:\Users\Admin\AppData\Local\Temp\7b4fb15f1c5d8a6baaa878884fc5366bb1398645ccbd5b348568270571208a1b.exe
watch
2⤵
PID:2608

memory/1272-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1272-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2608-133-0x0000000000000000-mapping.dmp

Download
memory/2608-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2608-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2608-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2608-143-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4860-134-0x0000000000000000-mapping.dmp

Download
memory/4860-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4860-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4860-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4860-142-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download