ab20b8ebee1bf77c4abb0b8ae33200bff0f7648c4f93458d16e536de2d5adab1

Analysis

max time kernel
44s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 13:25

Target

ab20b8ebee1bf77c4abb0b8ae33200bff0f7648c4f93458d16e536de2d5adab1.exe
Size

537KB
MD5

9a8852ca539ed721ab841dcf9e47ecf7
SHA1

3da922da41dcf8c2b57c087c703098b298effd0c
SHA256

ab20b8ebee1bf77c4abb0b8ae33200bff0f7648c4f93458d16e536de2d5adab1
SHA512

551a1bf20b4ada3b6246bbcdc5766b9b2a6c0dd8ea6ca3a25ff7ae82693a3a33c7150c10f23567b30e81f52ac212e41c8dad6ba3fa733c8cae93fa8803333dfd
SSDEEP

12288:S/a5CI5xjOvl8Gf9GCjctkDMNvvVWslpdc0/WfYrUTkuw:S/UxjmfsRtfjWsl3cDJ/w

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ab20b8ebee1bf77c4abb0b8ae33200bff0f7648c4f93458d16e536de2d5adab1.exe

description	pid	process	target process
PID 1528 wrote to memory of 1028	1528	ab20b8ebee1bf77c4abb0b8ae33200bff0f7648c4f93458d16e536de2d5adab1.exe	ab20b8ebee1bf77c4abb0b8ae33200bff0f7648c4f93458d16e536de2d5adab1.exe
PID 1528 wrote to memory of 1028	1528	ab20b8ebee1bf77c4abb0b8ae33200bff0f7648c4f93458d16e536de2d5adab1.exe	ab20b8ebee1bf77c4abb0b8ae33200bff0f7648c4f93458d16e536de2d5adab1.exe
PID 1528 wrote to memory of 1028	1528	ab20b8ebee1bf77c4abb0b8ae33200bff0f7648c4f93458d16e536de2d5adab1.exe	ab20b8ebee1bf77c4abb0b8ae33200bff0f7648c4f93458d16e536de2d5adab1.exe
PID 1528 wrote to memory of 1028	1528	ab20b8ebee1bf77c4abb0b8ae33200bff0f7648c4f93458d16e536de2d5adab1.exe	ab20b8ebee1bf77c4abb0b8ae33200bff0f7648c4f93458d16e536de2d5adab1.exe

C:\Users\Admin\AppData\Local\Temp\ab20b8ebee1bf77c4abb0b8ae33200bff0f7648c4f93458d16e536de2d5adab1.exe
"C:\Users\Admin\AppData\Local\Temp\ab20b8ebee1bf77c4abb0b8ae33200bff0f7648c4f93458d16e536de2d5adab1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Users\Admin\AppData\Local\Temp\ab20b8ebee1bf77c4abb0b8ae33200bff0f7648c4f93458d16e536de2d5adab1.exe
  tear
  2⤵
  PID:1028

memory/1028-55-0x0000000000000000-mapping.dmp

Download
memory/1028-57-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1028-59-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1028-60-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1528-54-0x0000000075021000-0x0000000075023000-memory.dmp

Filesize
8KB

Download
memory/1528-56-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download