ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496

Analysis

max time kernel
10s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 15:34

Target

ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496.exe
Size

537KB
MD5

041e704e2afab9ff442cbbd924b427b3
SHA1

ec451fd24dd2416c98692cab4427db2e2ccfcc9e
SHA256

ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496
SHA512

45a5694df2f6f73e80b9fc9478f45f01febbdc35001c8e92fadfe6f27de2ba710a6dd89fa56a37f8058742cc26922961aa2d54563fc4df80c78f32a70d9885a2
SSDEEP

12288:sdKz4lHD4TxfVPymGPfpyCqi8ka8nmCEJdTye63QmeQ:vz+j4F5yHpXqi8kJcDmeQ

Score

1^/10

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496.exe

description	pid	process	target process
PID 948 wrote to memory of 1332	948	ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496.exe	ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496.exe
PID 948 wrote to memory of 1332	948	ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496.exe	ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496.exe
PID 948 wrote to memory of 1332	948	ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496.exe	ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496.exe
PID 948 wrote to memory of 1332	948	ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496.exe	ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496.exe
PID 948 wrote to memory of 904	948	ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496.exe	ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496.exe
PID 948 wrote to memory of 904	948	ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496.exe	ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496.exe
PID 948 wrote to memory of 904	948	ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496.exe	ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496.exe
PID 948 wrote to memory of 904	948	ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496.exe	ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496.exe

C:\Users\Admin\AppData\Local\Temp\ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496.exe
"C:\Users\Admin\AppData\Local\Temp\ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:948
- C:\Users\Admin\AppData\Local\Temp\ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496.exe
  start
  2⤵
  PID:1332
- C:\Users\Admin\AppData\Local\Temp\ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496.exe
  watch
  2⤵
  PID:904

memory/904-56-0x0000000000000000-mapping.dmp

Download
memory/904-60-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/904-63-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/948-54-0x0000000075351000-0x0000000075353000-memory.dmp

Filesize
8KB

Download
memory/948-59-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1332-55-0x0000000000000000-mapping.dmp

Download
memory/1332-61-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1332-62-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download