0f5ef799b28af6e03accf2fb5e496f3bbef924cac569f1979300dbc9dd718f67

Analysis

max time kernel
39s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:12

Target

0f5ef799b28af6e03accf2fb5e496f3bbef924cac569f1979300dbc9dd718f67.exe
Size

523KB
MD5

2a10a457b62e58b05ef93ccc24138080
SHA1

5841cbfc026daa136e9f6fa467e54fd12da7b828
SHA256

0f5ef799b28af6e03accf2fb5e496f3bbef924cac569f1979300dbc9dd718f67
SHA512

ce8bbc5bace2b7caf8f28620b2a6c407f99c327d1f19e99cb1663c4f64d1ed77e7a90b63bb4af5a2b0a2aabe38d605869e45f45e01e1380db65dd46c8314968c
SSDEEP

6144:EonqgtwLlc2l/0hNmGU/XW4uLmz5oVHf6ZvYL0f0dxxxBfSIW/samc6ZsHRsGcI2:JqQDUubLmWJTDBfSV/samIReK7oLX

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

0f5ef799b28af6e03accf2fb5e496f3bbef924cac569f1979300dbc9dd718f67.exe

description	pid	process	target process
PID 1404 wrote to memory of 1016	1404	0f5ef799b28af6e03accf2fb5e496f3bbef924cac569f1979300dbc9dd718f67.exe	0f5ef799b28af6e03accf2fb5e496f3bbef924cac569f1979300dbc9dd718f67.exe
PID 1404 wrote to memory of 1016	1404	0f5ef799b28af6e03accf2fb5e496f3bbef924cac569f1979300dbc9dd718f67.exe	0f5ef799b28af6e03accf2fb5e496f3bbef924cac569f1979300dbc9dd718f67.exe
PID 1404 wrote to memory of 1016	1404	0f5ef799b28af6e03accf2fb5e496f3bbef924cac569f1979300dbc9dd718f67.exe	0f5ef799b28af6e03accf2fb5e496f3bbef924cac569f1979300dbc9dd718f67.exe
PID 1404 wrote to memory of 1016	1404	0f5ef799b28af6e03accf2fb5e496f3bbef924cac569f1979300dbc9dd718f67.exe	0f5ef799b28af6e03accf2fb5e496f3bbef924cac569f1979300dbc9dd718f67.exe
PID 1404 wrote to memory of 1016	1404	0f5ef799b28af6e03accf2fb5e496f3bbef924cac569f1979300dbc9dd718f67.exe	0f5ef799b28af6e03accf2fb5e496f3bbef924cac569f1979300dbc9dd718f67.exe
PID 1404 wrote to memory of 1016	1404	0f5ef799b28af6e03accf2fb5e496f3bbef924cac569f1979300dbc9dd718f67.exe	0f5ef799b28af6e03accf2fb5e496f3bbef924cac569f1979300dbc9dd718f67.exe
PID 1404 wrote to memory of 1016	1404	0f5ef799b28af6e03accf2fb5e496f3bbef924cac569f1979300dbc9dd718f67.exe	0f5ef799b28af6e03accf2fb5e496f3bbef924cac569f1979300dbc9dd718f67.exe

C:\Users\Admin\AppData\Local\Temp\0f5ef799b28af6e03accf2fb5e496f3bbef924cac569f1979300dbc9dd718f67.exe
"C:\Users\Admin\AppData\Local\Temp\0f5ef799b28af6e03accf2fb5e496f3bbef924cac569f1979300dbc9dd718f67.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1404

C:\Users\Admin\AppData\Local\Temp\0f5ef799b28af6e03accf2fb5e496f3bbef924cac569f1979300dbc9dd718f67.exe
tear
2⤵
PID:1016

memory/1016-56-0x0000000000000000-mapping.dmp

Download
memory/1016-59-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1016-60-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1404-54-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download
memory/1404-55-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1404-58-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download