d2a079cb4ca9f0112f8ef6f99bc743a8ab2de9130f22f130e8683a5530ee8a41

Analysis

max time kernel
42s
max time network
86s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 13:02

Target

d2a079cb4ca9f0112f8ef6f99bc743a8ab2de9130f22f130e8683a5530ee8a41.exe
Size

533KB
MD5

28ec86b4846c4be74a3cd9ddbd27314b
SHA1

023c1e52743fe5cd71896c1498693103fffd8307
SHA256

d2a079cb4ca9f0112f8ef6f99bc743a8ab2de9130f22f130e8683a5530ee8a41
SHA512

36aacd93ce209b52839196361f1ca99c98f68cfee4495e30b829ba83aae079f626492ad62871fcb0bf1897386947613df4940d48a0bcfaea5a06a7a2a2a64262
SSDEEP

12288:OH2ie6vlSlamD3x0GLM5ChzQ1RVykajY:RiHNkZ3x0GLrh01jyh0

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

d2a079cb4ca9f0112f8ef6f99bc743a8ab2de9130f22f130e8683a5530ee8a41.exe

description	pid	process	target process
PID 972 wrote to memory of 1960	972	d2a079cb4ca9f0112f8ef6f99bc743a8ab2de9130f22f130e8683a5530ee8a41.exe	d2a079cb4ca9f0112f8ef6f99bc743a8ab2de9130f22f130e8683a5530ee8a41.exe
PID 972 wrote to memory of 1960	972	d2a079cb4ca9f0112f8ef6f99bc743a8ab2de9130f22f130e8683a5530ee8a41.exe	d2a079cb4ca9f0112f8ef6f99bc743a8ab2de9130f22f130e8683a5530ee8a41.exe
PID 972 wrote to memory of 1960	972	d2a079cb4ca9f0112f8ef6f99bc743a8ab2de9130f22f130e8683a5530ee8a41.exe	d2a079cb4ca9f0112f8ef6f99bc743a8ab2de9130f22f130e8683a5530ee8a41.exe
PID 972 wrote to memory of 1960	972	d2a079cb4ca9f0112f8ef6f99bc743a8ab2de9130f22f130e8683a5530ee8a41.exe	d2a079cb4ca9f0112f8ef6f99bc743a8ab2de9130f22f130e8683a5530ee8a41.exe

C:\Users\Admin\AppData\Local\Temp\d2a079cb4ca9f0112f8ef6f99bc743a8ab2de9130f22f130e8683a5530ee8a41.exe
"C:\Users\Admin\AppData\Local\Temp\d2a079cb4ca9f0112f8ef6f99bc743a8ab2de9130f22f130e8683a5530ee8a41.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:972

C:\Users\Admin\AppData\Local\Temp\d2a079cb4ca9f0112f8ef6f99bc743a8ab2de9130f22f130e8683a5530ee8a41.exe
tear
2⤵
PID:1960

memory/972-54-0x00000000753D1000-0x00000000753D3000-memory.dmp

Filesize
8KB

Download
memory/972-56-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1960-55-0x0000000000000000-mapping.dmp

Download
memory/1960-58-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1960-59-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1960-60-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download