7b1984a6035406a6403fc7d5a4c40ffbad7d7287a977d0541399c21721dbc38e

Analysis

max time kernel
151s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:06

Target

7b1984a6035406a6403fc7d5a4c40ffbad7d7287a977d0541399c21721dbc38e.exe
Size

522KB
MD5

ac3563d27b14a4eef30e71d8efb8c623
SHA1

6553ac326766105c32faeba91ab969f816f04bc5
SHA256

7b1984a6035406a6403fc7d5a4c40ffbad7d7287a977d0541399c21721dbc38e
SHA512

4cdfab1a7ec94fef6d95ba5fc9e518cd60c0908814af6ac8b162316d19570faa15be68b041ea1125a689fe0ffb9146ad545cc5e97df6ff96e3dac5e3405c6bc1
SSDEEP

12288:D7nYheRDEQgdbdTM1/OwYYlLPt5oKnWq3JbVM:wtQgdbeflLPt5/WwVM

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

7b1984a6035406a6403fc7d5a4c40ffbad7d7287a977d0541399c21721dbc38e.exe

description	pid	process	target process
PID 64 wrote to memory of 1268	64	7b1984a6035406a6403fc7d5a4c40ffbad7d7287a977d0541399c21721dbc38e.exe	7b1984a6035406a6403fc7d5a4c40ffbad7d7287a977d0541399c21721dbc38e.exe
PID 64 wrote to memory of 1268	64	7b1984a6035406a6403fc7d5a4c40ffbad7d7287a977d0541399c21721dbc38e.exe	7b1984a6035406a6403fc7d5a4c40ffbad7d7287a977d0541399c21721dbc38e.exe
PID 64 wrote to memory of 1268	64	7b1984a6035406a6403fc7d5a4c40ffbad7d7287a977d0541399c21721dbc38e.exe	7b1984a6035406a6403fc7d5a4c40ffbad7d7287a977d0541399c21721dbc38e.exe
PID 64 wrote to memory of 852	64	7b1984a6035406a6403fc7d5a4c40ffbad7d7287a977d0541399c21721dbc38e.exe	7b1984a6035406a6403fc7d5a4c40ffbad7d7287a977d0541399c21721dbc38e.exe
PID 64 wrote to memory of 852	64	7b1984a6035406a6403fc7d5a4c40ffbad7d7287a977d0541399c21721dbc38e.exe	7b1984a6035406a6403fc7d5a4c40ffbad7d7287a977d0541399c21721dbc38e.exe
PID 64 wrote to memory of 852	64	7b1984a6035406a6403fc7d5a4c40ffbad7d7287a977d0541399c21721dbc38e.exe	7b1984a6035406a6403fc7d5a4c40ffbad7d7287a977d0541399c21721dbc38e.exe

C:\Users\Admin\AppData\Local\Temp\7b1984a6035406a6403fc7d5a4c40ffbad7d7287a977d0541399c21721dbc38e.exe
"C:\Users\Admin\AppData\Local\Temp\7b1984a6035406a6403fc7d5a4c40ffbad7d7287a977d0541399c21721dbc38e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:64

C:\Users\Admin\AppData\Local\Temp\7b1984a6035406a6403fc7d5a4c40ffbad7d7287a977d0541399c21721dbc38e.exe
start
2⤵
PID:1268

C:\Users\Admin\AppData\Local\Temp\7b1984a6035406a6403fc7d5a4c40ffbad7d7287a977d0541399c21721dbc38e.exe
watch
2⤵
PID:852

memory/64-132-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/64-135-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/852-133-0x0000000000000000-mapping.dmp

Download
memory/852-137-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/852-139-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/852-141-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1268-134-0x0000000000000000-mapping.dmp

Download
memory/1268-136-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1268-138-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1268-140-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download