b3a81145b41ec5ce09bd4f597ddc0bfba42427231a13da1ff91ead7d4c3b3a70

Analysis

max time kernel
47s
max time network
97s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 13:19

Target

b3a81145b41ec5ce09bd4f597ddc0bfba42427231a13da1ff91ead7d4c3b3a70.exe
Size

530KB
MD5

1ec1cc356efdfd7932dd28deab7ac9ca
SHA1

c919e6a421e9ec15e46ebb2fe1ab18e41c00bed4
SHA256

b3a81145b41ec5ce09bd4f597ddc0bfba42427231a13da1ff91ead7d4c3b3a70
SHA512

136be53b6b6e20eb3c28fea0ecd06c85b4b3a47ccf4ef2066bec25ccee194deb5e0aed6721555530faa13b527ae9b30529151096354ac0fd8abf2b9d204e843e
SSDEEP

12288:wYBqDU0FqOeV6gYQVW3zNGZspc1mmIFGtJaY1bC:NghFWVJYQVW3zsZspc1mmDtJN

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

b3a81145b41ec5ce09bd4f597ddc0bfba42427231a13da1ff91ead7d4c3b3a70.exe

description	pid	process	target process
PID 1428 wrote to memory of 2036	1428	b3a81145b41ec5ce09bd4f597ddc0bfba42427231a13da1ff91ead7d4c3b3a70.exe	b3a81145b41ec5ce09bd4f597ddc0bfba42427231a13da1ff91ead7d4c3b3a70.exe
PID 1428 wrote to memory of 2036	1428	b3a81145b41ec5ce09bd4f597ddc0bfba42427231a13da1ff91ead7d4c3b3a70.exe	b3a81145b41ec5ce09bd4f597ddc0bfba42427231a13da1ff91ead7d4c3b3a70.exe
PID 1428 wrote to memory of 2036	1428	b3a81145b41ec5ce09bd4f597ddc0bfba42427231a13da1ff91ead7d4c3b3a70.exe	b3a81145b41ec5ce09bd4f597ddc0bfba42427231a13da1ff91ead7d4c3b3a70.exe
PID 1428 wrote to memory of 2036	1428	b3a81145b41ec5ce09bd4f597ddc0bfba42427231a13da1ff91ead7d4c3b3a70.exe	b3a81145b41ec5ce09bd4f597ddc0bfba42427231a13da1ff91ead7d4c3b3a70.exe

C:\Users\Admin\AppData\Local\Temp\b3a81145b41ec5ce09bd4f597ddc0bfba42427231a13da1ff91ead7d4c3b3a70.exe
"C:\Users\Admin\AppData\Local\Temp\b3a81145b41ec5ce09bd4f597ddc0bfba42427231a13da1ff91ead7d4c3b3a70.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Users\Admin\AppData\Local\Temp\b3a81145b41ec5ce09bd4f597ddc0bfba42427231a13da1ff91ead7d4c3b3a70.exe
  tear
  2⤵
  PID:2036

memory/1428-54-0x0000000075591000-0x0000000075593000-memory.dmp

Filesize
8KB

Download
memory/1428-56-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2036-55-0x0000000000000000-mapping.dmp

Download
memory/2036-58-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2036-59-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download