0d5f5807f51ef1901bb4005932735d474e0372713f088a2893650bfa932c903a

Analysis

max time kernel
69s
max time network
111s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 23:24

Target

program.exe
Size

506KB
MD5

127ce0aef5e9c51673c4644bf205929a
SHA1

a2f4dec0918f8d1a29fff20f528beecdb40f67eb
SHA256

724f00bf16011e29b44f7bd7cac11e0f59382fb57984e44a6569bfa6e1ebdfba
SHA512

2dd64c77ef45de9718f4c4afdc52d0772cc62cd2f1b238759fcede493ab9df1fe6e769133efd85330fe678d05645390d8323adce8ff4d799495fe5e99edfb712
SSDEEP

6144:ICo8GureQtfET12vqqX0IMNkXUb/CIOrLBZJG98/QxhR/WTEouylUUotE2:ICoXuKQp7RpdkvuLBZJfiHGlUz

Score

1^/10

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 820	1204	program.exe	28
PID 1204 wrote to memory of 820	1204	program.exe	28
PID 1204 wrote to memory of 820	1204	program.exe	28
PID 1204 wrote to memory of 820	1204	program.exe	28
PID 1204 wrote to memory of 2028	1204	program.exe	29
PID 1204 wrote to memory of 2028	1204	program.exe	29
PID 1204 wrote to memory of 2028	1204	program.exe	29
PID 1204 wrote to memory of 2028	1204	program.exe	29

C:\Users\Admin\AppData\Local\Temp\program.exe
"C:\Users\Admin\AppData\Local\Temp\program.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Users\Admin\AppData\Local\Temp\program.exe
  start
  2⤵
  PID:820
- C:\Users\Admin\AppData\Local\Temp\program.exe
  watch
  2⤵
  PID:2028

memory/820-61-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/820-63-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/820-65-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1204-54-0x0000000075991000-0x0000000075993000-memory.dmp

Filesize
8KB

Download
memory/1204-55-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1204-60-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2028-62-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2028-64-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2028-66-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download