57f4e85db6b6032a53b017c63f82353bd26f7ef402e60596d7dcb4718883cb7e

Analysis

max time kernel
52s
max time network
66s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 14:15

Target

57f4e85db6b6032a53b017c63f82353bd26f7ef402e60596d7dcb4718883cb7e.exe
Size

533KB
MD5

0b33b628815c2443163229881a048980
SHA1

fc071095840f8736420bf35fe6b2b143f431d499
SHA256

57f4e85db6b6032a53b017c63f82353bd26f7ef402e60596d7dcb4718883cb7e
SHA512

ea7e186c1625ff84a12f268ed7206a060595db88cf63cd7063432437e22a47df105bfcbfc80d10f8a10f825bc588fd2775999f3d0825544bdca686056db41fa6
SSDEEP

12288:Endap5f5pZwD8hkXrix0GLM5ChzQ1RVykQjY:r5pKAtx0GLrh01jyD0

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

57f4e85db6b6032a53b017c63f82353bd26f7ef402e60596d7dcb4718883cb7e.exe

description	pid	process	target process
PID 1244 wrote to memory of 1052	1244	57f4e85db6b6032a53b017c63f82353bd26f7ef402e60596d7dcb4718883cb7e.exe	57f4e85db6b6032a53b017c63f82353bd26f7ef402e60596d7dcb4718883cb7e.exe
PID 1244 wrote to memory of 1052	1244	57f4e85db6b6032a53b017c63f82353bd26f7ef402e60596d7dcb4718883cb7e.exe	57f4e85db6b6032a53b017c63f82353bd26f7ef402e60596d7dcb4718883cb7e.exe
PID 1244 wrote to memory of 1052	1244	57f4e85db6b6032a53b017c63f82353bd26f7ef402e60596d7dcb4718883cb7e.exe	57f4e85db6b6032a53b017c63f82353bd26f7ef402e60596d7dcb4718883cb7e.exe
PID 1244 wrote to memory of 1052	1244	57f4e85db6b6032a53b017c63f82353bd26f7ef402e60596d7dcb4718883cb7e.exe	57f4e85db6b6032a53b017c63f82353bd26f7ef402e60596d7dcb4718883cb7e.exe

C:\Users\Admin\AppData\Local\Temp\57f4e85db6b6032a53b017c63f82353bd26f7ef402e60596d7dcb4718883cb7e.exe
"C:\Users\Admin\AppData\Local\Temp\57f4e85db6b6032a53b017c63f82353bd26f7ef402e60596d7dcb4718883cb7e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Users\Admin\AppData\Local\Temp\57f4e85db6b6032a53b017c63f82353bd26f7ef402e60596d7dcb4718883cb7e.exe
  tear
  2⤵
  PID:1052

memory/1052-56-0x0000000000000000-mapping.dmp

Download
memory/1052-59-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1052-60-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1052-61-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1244-54-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1244-55-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download
memory/1244-57-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download