e221a89b93d9cfd0956397e1cc94e0ee79edb1495e2e88f0788acb897c357916

Analysis

max time kernel
52s
max time network
101s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 12:52

Target

e221a89b93d9cfd0956397e1cc94e0ee79edb1495e2e88f0788acb897c357916.exe
Size

530KB
MD5

2cd4b01f48425f12c01fb74275c0f9b1
SHA1

97f2d81d6b22151a5dd2025f2c4c75e56ebca124
SHA256

e221a89b93d9cfd0956397e1cc94e0ee79edb1495e2e88f0788acb897c357916
SHA512

1d205cd01bf014f8424339f395277057d2cbacf8a9a4a69d7f43a33e8b5ed607552c6c2b04d41f21b2f6dcb76fbd2b7d57bec29c2a7b99e92927843547513d85
SSDEEP

12288:oh+8z4ldnLXUO/xyEuzNGZspc1mmIFGtJaY1bF1:yzIdn3/ruzsZspc1mmDtJNR

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

e221a89b93d9cfd0956397e1cc94e0ee79edb1495e2e88f0788acb897c357916.exe

description	pid	process	target process
PID 1148 wrote to memory of 1596	1148	e221a89b93d9cfd0956397e1cc94e0ee79edb1495e2e88f0788acb897c357916.exe	e221a89b93d9cfd0956397e1cc94e0ee79edb1495e2e88f0788acb897c357916.exe
PID 1148 wrote to memory of 1596	1148	e221a89b93d9cfd0956397e1cc94e0ee79edb1495e2e88f0788acb897c357916.exe	e221a89b93d9cfd0956397e1cc94e0ee79edb1495e2e88f0788acb897c357916.exe
PID 1148 wrote to memory of 1596	1148	e221a89b93d9cfd0956397e1cc94e0ee79edb1495e2e88f0788acb897c357916.exe	e221a89b93d9cfd0956397e1cc94e0ee79edb1495e2e88f0788acb897c357916.exe
PID 1148 wrote to memory of 1596	1148	e221a89b93d9cfd0956397e1cc94e0ee79edb1495e2e88f0788acb897c357916.exe	e221a89b93d9cfd0956397e1cc94e0ee79edb1495e2e88f0788acb897c357916.exe

C:\Users\Admin\AppData\Local\Temp\e221a89b93d9cfd0956397e1cc94e0ee79edb1495e2e88f0788acb897c357916.exe
"C:\Users\Admin\AppData\Local\Temp\e221a89b93d9cfd0956397e1cc94e0ee79edb1495e2e88f0788acb897c357916.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1148

C:\Users\Admin\AppData\Local\Temp\e221a89b93d9cfd0956397e1cc94e0ee79edb1495e2e88f0788acb897c357916.exe
tear
2⤵
PID:1596

memory/1148-54-0x0000000075001000-0x0000000075003000-memory.dmp

Filesize
8KB

Download
memory/1148-57-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1596-55-0x0000000000000000-mapping.dmp

Download
memory/1596-58-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1596-59-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download