f2a48d52921ddcd5cc31f7baec882e951fc3af52cadce9c8fda9ddc4425387cf

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 12:43

Target

f2a48d52921ddcd5cc31f7baec882e951fc3af52cadce9c8fda9ddc4425387cf.exe
Size

532KB
MD5

8fa724d0d55049025b373dc130cd0c59
SHA1

a1de3f22b149829b127c5525e8611ca82ec808da
SHA256

f2a48d52921ddcd5cc31f7baec882e951fc3af52cadce9c8fda9ddc4425387cf
SHA512

9e57a4fe711b5efc81f9acd43130fa4d36ac8bfff58f6f1207fdd017172ab7465c3e3ee37465b447c8028a959ec51d519c203f751d5270629292ee41a6bf2389
SSDEEP

12288:2okdheZ3RYsUfMzjPh2RIbWcoIFFEgB9nP1c:2owcTjp0IbWcoIFagbPa

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

f2a48d52921ddcd5cc31f7baec882e951fc3af52cadce9c8fda9ddc4425387cf.exe

description	pid	process	target process
PID 1976 wrote to memory of 1900	1976	f2a48d52921ddcd5cc31f7baec882e951fc3af52cadce9c8fda9ddc4425387cf.exe	f2a48d52921ddcd5cc31f7baec882e951fc3af52cadce9c8fda9ddc4425387cf.exe
PID 1976 wrote to memory of 1900	1976	f2a48d52921ddcd5cc31f7baec882e951fc3af52cadce9c8fda9ddc4425387cf.exe	f2a48d52921ddcd5cc31f7baec882e951fc3af52cadce9c8fda9ddc4425387cf.exe
PID 1976 wrote to memory of 1900	1976	f2a48d52921ddcd5cc31f7baec882e951fc3af52cadce9c8fda9ddc4425387cf.exe	f2a48d52921ddcd5cc31f7baec882e951fc3af52cadce9c8fda9ddc4425387cf.exe
PID 1976 wrote to memory of 1900	1976	f2a48d52921ddcd5cc31f7baec882e951fc3af52cadce9c8fda9ddc4425387cf.exe	f2a48d52921ddcd5cc31f7baec882e951fc3af52cadce9c8fda9ddc4425387cf.exe

C:\Users\Admin\AppData\Local\Temp\f2a48d52921ddcd5cc31f7baec882e951fc3af52cadce9c8fda9ddc4425387cf.exe
"C:\Users\Admin\AppData\Local\Temp\f2a48d52921ddcd5cc31f7baec882e951fc3af52cadce9c8fda9ddc4425387cf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Users\Admin\AppData\Local\Temp\f2a48d52921ddcd5cc31f7baec882e951fc3af52cadce9c8fda9ddc4425387cf.exe
  tear
  2⤵
  PID:1900

memory/1900-55-0x0000000000000000-mapping.dmp

Download
memory/1900-58-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1900-59-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1976-54-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

Filesize
8KB

Download
memory/1976-57-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download