2b006f20fb01ef5d4580a660ffbc1ba3ebafef5103f6ffe7854983b51ceb479e

Analysis

max time kernel
36s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 12:19

Target

2b006f20fb01ef5d4580a660ffbc1ba3ebafef5103f6ffe7854983b51ceb479e.exe
Size

526KB
MD5

2286bf77a0c07f76921afd4016290a28
SHA1

4775b01b895a420bce9423bd27f8e7d8a7a19834
SHA256

2b006f20fb01ef5d4580a660ffbc1ba3ebafef5103f6ffe7854983b51ceb479e
SHA512

c118aeb03bc6df57f5d6e6d651ddf337613182954d6c24a27a6b23da2754af09df4a9158ee867313441263354895a759bb83d732880ab432b06002a6ed782a34
SSDEEP

12288:gwwyD/t0RKQL2G3TDrd0VBly18xQqpx8O5Epk:bwyDSRKfG37d0Blatqpx8pk

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

2b006f20fb01ef5d4580a660ffbc1ba3ebafef5103f6ffe7854983b51ceb479e.exe

description	pid	process	target process
PID 604 wrote to memory of 1284	604	2b006f20fb01ef5d4580a660ffbc1ba3ebafef5103f6ffe7854983b51ceb479e.exe	2b006f20fb01ef5d4580a660ffbc1ba3ebafef5103f6ffe7854983b51ceb479e.exe
PID 604 wrote to memory of 1284	604	2b006f20fb01ef5d4580a660ffbc1ba3ebafef5103f6ffe7854983b51ceb479e.exe	2b006f20fb01ef5d4580a660ffbc1ba3ebafef5103f6ffe7854983b51ceb479e.exe
PID 604 wrote to memory of 1284	604	2b006f20fb01ef5d4580a660ffbc1ba3ebafef5103f6ffe7854983b51ceb479e.exe	2b006f20fb01ef5d4580a660ffbc1ba3ebafef5103f6ffe7854983b51ceb479e.exe
PID 604 wrote to memory of 1284	604	2b006f20fb01ef5d4580a660ffbc1ba3ebafef5103f6ffe7854983b51ceb479e.exe	2b006f20fb01ef5d4580a660ffbc1ba3ebafef5103f6ffe7854983b51ceb479e.exe
PID 604 wrote to memory of 1284	604	2b006f20fb01ef5d4580a660ffbc1ba3ebafef5103f6ffe7854983b51ceb479e.exe	2b006f20fb01ef5d4580a660ffbc1ba3ebafef5103f6ffe7854983b51ceb479e.exe
PID 604 wrote to memory of 1284	604	2b006f20fb01ef5d4580a660ffbc1ba3ebafef5103f6ffe7854983b51ceb479e.exe	2b006f20fb01ef5d4580a660ffbc1ba3ebafef5103f6ffe7854983b51ceb479e.exe
PID 604 wrote to memory of 1284	604	2b006f20fb01ef5d4580a660ffbc1ba3ebafef5103f6ffe7854983b51ceb479e.exe	2b006f20fb01ef5d4580a660ffbc1ba3ebafef5103f6ffe7854983b51ceb479e.exe

C:\Users\Admin\AppData\Local\Temp\2b006f20fb01ef5d4580a660ffbc1ba3ebafef5103f6ffe7854983b51ceb479e.exe
"C:\Users\Admin\AppData\Local\Temp\2b006f20fb01ef5d4580a660ffbc1ba3ebafef5103f6ffe7854983b51ceb479e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:604

C:\Users\Admin\AppData\Local\Temp\2b006f20fb01ef5d4580a660ffbc1ba3ebafef5103f6ffe7854983b51ceb479e.exe
tear
2⤵
PID:1284

memory/604-54-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/604-55-0x0000000075F81000-0x0000000075F83000-memory.dmp

Filesize
8KB

Download
memory/604-57-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1284-56-0x0000000000000000-mapping.dmp

Download
memory/1284-58-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1284-60-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1284-61-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download