6691a61f6dad9a10618d7f0b0655b7d500c0870a39558654e4a41f3f3bcfb1d8

Analysis

max time kernel
36s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 15:46

Target

6691a61f6dad9a10618d7f0b0655b7d500c0870a39558654e4a41f3f3bcfb1d8.exe
Size

29KB
MD5

ae63b3af3302bb1352e6bad55f7443f7
SHA1

9ab7f53332b1adbbfe251706d7e8698d4719997d
SHA256

6691a61f6dad9a10618d7f0b0655b7d500c0870a39558654e4a41f3f3bcfb1d8
SHA512

3ff1f393b81b8efec933779b6c266995dacb5ad0157a2ab7b81fe4bdf7306a08193312f2e650a91cf4b105d49527ef412a5463243ace24417162cb657e89ceef
SSDEEP

768:geLMhlzjRKiQWgdgmWhtaHxNZbR3Xe9lZ3FD:1AzjRpngfsaHv3eJx

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

6691a61f6dad9a10618d7f0b0655b7d500c0870a39558654e4a41f3f3bcfb1d8.exe

pid	process
1720	6691a61f6dad9a10618d7f0b0655b7d500c0870a39558654e4a41f3f3bcfb1d8.exe
1720	6691a61f6dad9a10618d7f0b0655b7d500c0870a39558654e4a41f3f3bcfb1d8.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6691a61f6dad9a10618d7f0b0655b7d500c0870a39558654e4a41f3f3bcfb1d8.exe

description	pid	process	target process
PID 1720 wrote to memory of 1400	1720	6691a61f6dad9a10618d7f0b0655b7d500c0870a39558654e4a41f3f3bcfb1d8.exe	Explorer.EXE
PID 1720 wrote to memory of 1400	1720	6691a61f6dad9a10618d7f0b0655b7d500c0870a39558654e4a41f3f3bcfb1d8.exe	Explorer.EXE
PID 1720 wrote to memory of 1400	1720	6691a61f6dad9a10618d7f0b0655b7d500c0870a39558654e4a41f3f3bcfb1d8.exe	Explorer.EXE
PID 1720 wrote to memory of 1400	1720	6691a61f6dad9a10618d7f0b0655b7d500c0870a39558654e4a41f3f3bcfb1d8.exe	Explorer.EXE

memory/1400-56-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1720-54-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/1720-55-0x00000000762B1000-0x00000000762B3000-memory.dmp

Filesize
8KB

Download
memory/1720-59-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download