b006e601194feeaa6e1eb7a543b376093b765269c98b87550c4b08bc429c9897

Analysis

max time kernel
58s
max time network
63s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 13:22

Target

b006e601194feeaa6e1eb7a543b376093b765269c98b87550c4b08bc429c9897.exe
Size

528KB
MD5

1b114161d680ad6847a1bb38ed660044
SHA1

771833a34ace14ac226c6393515aa379a976e872
SHA256

b006e601194feeaa6e1eb7a543b376093b765269c98b87550c4b08bc429c9897
SHA512

7101992173692f37038eed24486d4a6e73cb6066c7bfcd7ac1ed69a6261d2461191904deb5fb1262dcd7eb0b1476172f8a2c6658e0c5d8b70468cb9d32b22285
SSDEEP

12288:X0oKOKqC4vwAYQGTB0wh2DhqpnAToZKQm7c:X0Lqn9Y/F0wS8KQm

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

b006e601194feeaa6e1eb7a543b376093b765269c98b87550c4b08bc429c9897.exe

description	pid	process	target process
PID 1372 wrote to memory of 864	1372	b006e601194feeaa6e1eb7a543b376093b765269c98b87550c4b08bc429c9897.exe	b006e601194feeaa6e1eb7a543b376093b765269c98b87550c4b08bc429c9897.exe
PID 1372 wrote to memory of 864	1372	b006e601194feeaa6e1eb7a543b376093b765269c98b87550c4b08bc429c9897.exe	b006e601194feeaa6e1eb7a543b376093b765269c98b87550c4b08bc429c9897.exe
PID 1372 wrote to memory of 864	1372	b006e601194feeaa6e1eb7a543b376093b765269c98b87550c4b08bc429c9897.exe	b006e601194feeaa6e1eb7a543b376093b765269c98b87550c4b08bc429c9897.exe
PID 1372 wrote to memory of 864	1372	b006e601194feeaa6e1eb7a543b376093b765269c98b87550c4b08bc429c9897.exe	b006e601194feeaa6e1eb7a543b376093b765269c98b87550c4b08bc429c9897.exe

C:\Users\Admin\AppData\Local\Temp\b006e601194feeaa6e1eb7a543b376093b765269c98b87550c4b08bc429c9897.exe
"C:\Users\Admin\AppData\Local\Temp\b006e601194feeaa6e1eb7a543b376093b765269c98b87550c4b08bc429c9897.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Users\Admin\AppData\Local\Temp\b006e601194feeaa6e1eb7a543b376093b765269c98b87550c4b08bc429c9897.exe
  tear
  2⤵
  PID:864

memory/864-55-0x0000000000000000-mapping.dmp

Download
memory/864-58-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/864-59-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1372-54-0x0000000076B51000-0x0000000076B53000-memory.dmp

Filesize
8KB

Download
memory/1372-56-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download