f3372189ab28982eed7c459388d9b1b157e41a0cbfdbfe24354d70dc404646c2

Analysis

max time kernel
25s
max time network
37s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 12:43

Target

f3372189ab28982eed7c459388d9b1b157e41a0cbfdbfe24354d70dc404646c2.exe
Size

524KB
MD5

45fe2fd5e93a4f3239cd51dd0f4f0855
SHA1

42e7659aa5c0c6cf0b8a6ebe64afdf15a69707df
SHA256

f3372189ab28982eed7c459388d9b1b157e41a0cbfdbfe24354d70dc404646c2
SHA512

d4e116dcd4571c2de8c4b4227645067e4844658b9cef0a9c59f007abde4c0bc92a976604b1cf1296dbf29c4b75947d322120f9d2b79b7cc7e77875edd58d809d
SSDEEP

12288:g5aaywJDpbSOuVdMWfb6gNbplVzvBVKXCuapzDBG:SdJD0OuVdMW+OHVzvSXCXD

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

f3372189ab28982eed7c459388d9b1b157e41a0cbfdbfe24354d70dc404646c2.exe

description	pid	process	target process
PID 1612 wrote to memory of 1272	1612	f3372189ab28982eed7c459388d9b1b157e41a0cbfdbfe24354d70dc404646c2.exe	f3372189ab28982eed7c459388d9b1b157e41a0cbfdbfe24354d70dc404646c2.exe
PID 1612 wrote to memory of 1272	1612	f3372189ab28982eed7c459388d9b1b157e41a0cbfdbfe24354d70dc404646c2.exe	f3372189ab28982eed7c459388d9b1b157e41a0cbfdbfe24354d70dc404646c2.exe
PID 1612 wrote to memory of 1272	1612	f3372189ab28982eed7c459388d9b1b157e41a0cbfdbfe24354d70dc404646c2.exe	f3372189ab28982eed7c459388d9b1b157e41a0cbfdbfe24354d70dc404646c2.exe
PID 1612 wrote to memory of 1272	1612	f3372189ab28982eed7c459388d9b1b157e41a0cbfdbfe24354d70dc404646c2.exe	f3372189ab28982eed7c459388d9b1b157e41a0cbfdbfe24354d70dc404646c2.exe

C:\Users\Admin\AppData\Local\Temp\f3372189ab28982eed7c459388d9b1b157e41a0cbfdbfe24354d70dc404646c2.exe
"C:\Users\Admin\AppData\Local\Temp\f3372189ab28982eed7c459388d9b1b157e41a0cbfdbfe24354d70dc404646c2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1612

C:\Users\Admin\AppData\Local\Temp\f3372189ab28982eed7c459388d9b1b157e41a0cbfdbfe24354d70dc404646c2.exe
tear
2⤵
PID:1272

memory/1272-55-0x0000000000000000-mapping.dmp

Download
memory/1272-58-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1272-59-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1612-54-0x00000000764C1000-0x00000000764C3000-memory.dmp

Filesize
8KB

Download
memory/1612-56-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download