c0ba04e2ab3a018bf3b9cda4435c477f9ae44a2c6b5d22996f5823dd2a13fd4b

Analysis

max time kernel
30s
max time network
59s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 13:12

Target

c0ba04e2ab3a018bf3b9cda4435c477f9ae44a2c6b5d22996f5823dd2a13fd4b.exe
Size

524KB
MD5

24750ebb3feafdfdf787d45c47510050
SHA1

80ac7e556a09a1ed1095fd73efb3f19bc60f993d
SHA256

c0ba04e2ab3a018bf3b9cda4435c477f9ae44a2c6b5d22996f5823dd2a13fd4b
SHA512

e2d29f72ff5ecce4ff8fc7206532103bdd217cc4f643be8e71b0adadd9ce2d924fe179e658ad7bd8df0310ef5e3cf64c9dcc98ebdc720b6fa71b99c3eb8bdedd
SSDEEP

12288:b325RheToxYzr2G0hJ1Nzd2veeVzvBVKXCuapzDBG:bERkT6YfTShzdgVzvSXCXD

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c0ba04e2ab3a018bf3b9cda4435c477f9ae44a2c6b5d22996f5823dd2a13fd4b.exe

description	pid	process	target process
PID 1972 wrote to memory of 1704	1972	c0ba04e2ab3a018bf3b9cda4435c477f9ae44a2c6b5d22996f5823dd2a13fd4b.exe	c0ba04e2ab3a018bf3b9cda4435c477f9ae44a2c6b5d22996f5823dd2a13fd4b.exe
PID 1972 wrote to memory of 1704	1972	c0ba04e2ab3a018bf3b9cda4435c477f9ae44a2c6b5d22996f5823dd2a13fd4b.exe	c0ba04e2ab3a018bf3b9cda4435c477f9ae44a2c6b5d22996f5823dd2a13fd4b.exe
PID 1972 wrote to memory of 1704	1972	c0ba04e2ab3a018bf3b9cda4435c477f9ae44a2c6b5d22996f5823dd2a13fd4b.exe	c0ba04e2ab3a018bf3b9cda4435c477f9ae44a2c6b5d22996f5823dd2a13fd4b.exe
PID 1972 wrote to memory of 1704	1972	c0ba04e2ab3a018bf3b9cda4435c477f9ae44a2c6b5d22996f5823dd2a13fd4b.exe	c0ba04e2ab3a018bf3b9cda4435c477f9ae44a2c6b5d22996f5823dd2a13fd4b.exe

C:\Users\Admin\AppData\Local\Temp\c0ba04e2ab3a018bf3b9cda4435c477f9ae44a2c6b5d22996f5823dd2a13fd4b.exe
"C:\Users\Admin\AppData\Local\Temp\c0ba04e2ab3a018bf3b9cda4435c477f9ae44a2c6b5d22996f5823dd2a13fd4b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Users\Admin\AppData\Local\Temp\c0ba04e2ab3a018bf3b9cda4435c477f9ae44a2c6b5d22996f5823dd2a13fd4b.exe
  tear
  2⤵
  PID:1704

memory/1704-55-0x0000000000000000-mapping.dmp

Download
memory/1704-57-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1704-59-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1704-60-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1972-54-0x0000000074D81000-0x0000000074D83000-memory.dmp

Filesize
8KB

Download
memory/1972-56-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download