b64c0ce3a6a21d38f1644e26e2d49ed9c424a96a91c0d44af5482ec462962f28

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 13:17

Target

b64c0ce3a6a21d38f1644e26e2d49ed9c424a96a91c0d44af5482ec462962f28.exe
Size

528KB
MD5

502db6c544938b9341b1798c4a3b6e8a
SHA1

483e5bcbbafdc0a783a313ab2921ca5d2aaf3a41
SHA256

b64c0ce3a6a21d38f1644e26e2d49ed9c424a96a91c0d44af5482ec462962f28
SHA512

1d5c3281e4436bcfe35e0d6b73ff7320904c788802a9e32a89edd1befe8042780ebff364db0e3ff143e0b49c443e3e5c70b16b1a119438828c70545db096ad84
SSDEEP

12288:JMyZWn3If1q+gdzI0dp0wh2DhqpnAToZfQmH:JMyZxw+g/v0wS8fQm

Score

1^/10

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

b64c0ce3a6a21d38f1644e26e2d49ed9c424a96a91c0d44af5482ec462962f28.exe

description	pid	process	target process
PID 1292 wrote to memory of 2012	1292	b64c0ce3a6a21d38f1644e26e2d49ed9c424a96a91c0d44af5482ec462962f28.exe	b64c0ce3a6a21d38f1644e26e2d49ed9c424a96a91c0d44af5482ec462962f28.exe
PID 1292 wrote to memory of 2012	1292	b64c0ce3a6a21d38f1644e26e2d49ed9c424a96a91c0d44af5482ec462962f28.exe	b64c0ce3a6a21d38f1644e26e2d49ed9c424a96a91c0d44af5482ec462962f28.exe
PID 1292 wrote to memory of 2012	1292	b64c0ce3a6a21d38f1644e26e2d49ed9c424a96a91c0d44af5482ec462962f28.exe	b64c0ce3a6a21d38f1644e26e2d49ed9c424a96a91c0d44af5482ec462962f28.exe
PID 1292 wrote to memory of 2012	1292	b64c0ce3a6a21d38f1644e26e2d49ed9c424a96a91c0d44af5482ec462962f28.exe	b64c0ce3a6a21d38f1644e26e2d49ed9c424a96a91c0d44af5482ec462962f28.exe
PID 1292 wrote to memory of 1080	1292	b64c0ce3a6a21d38f1644e26e2d49ed9c424a96a91c0d44af5482ec462962f28.exe	b64c0ce3a6a21d38f1644e26e2d49ed9c424a96a91c0d44af5482ec462962f28.exe
PID 1292 wrote to memory of 1080	1292	b64c0ce3a6a21d38f1644e26e2d49ed9c424a96a91c0d44af5482ec462962f28.exe	b64c0ce3a6a21d38f1644e26e2d49ed9c424a96a91c0d44af5482ec462962f28.exe
PID 1292 wrote to memory of 1080	1292	b64c0ce3a6a21d38f1644e26e2d49ed9c424a96a91c0d44af5482ec462962f28.exe	b64c0ce3a6a21d38f1644e26e2d49ed9c424a96a91c0d44af5482ec462962f28.exe
PID 1292 wrote to memory of 1080	1292	b64c0ce3a6a21d38f1644e26e2d49ed9c424a96a91c0d44af5482ec462962f28.exe	b64c0ce3a6a21d38f1644e26e2d49ed9c424a96a91c0d44af5482ec462962f28.exe

C:\Users\Admin\AppData\Local\Temp\b64c0ce3a6a21d38f1644e26e2d49ed9c424a96a91c0d44af5482ec462962f28.exe
"C:\Users\Admin\AppData\Local\Temp\b64c0ce3a6a21d38f1644e26e2d49ed9c424a96a91c0d44af5482ec462962f28.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Users\Admin\AppData\Local\Temp\b64c0ce3a6a21d38f1644e26e2d49ed9c424a96a91c0d44af5482ec462962f28.exe
  start
  2⤵
  PID:2012
- C:\Users\Admin\AppData\Local\Temp\b64c0ce3a6a21d38f1644e26e2d49ed9c424a96a91c0d44af5482ec462962f28.exe
  watch
  2⤵
  PID:1080

memory/1080-55-0x0000000000000000-mapping.dmp

Download
memory/1080-60-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1080-61-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1080-64-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1292-54-0x00000000762E1000-0x00000000762E3000-memory.dmp

Filesize
8KB

Download
memory/1292-59-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2012-56-0x0000000000000000-mapping.dmp

Download
memory/2012-62-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2012-63-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download