8d24b4ade76437703abc1217753abc05dc34a7d693cd47ad41c98d77888c9a2c

Analysis

max time kernel
47s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 23:35

Target

key_panda.exe
Size

506KB
MD5

c184a0f6f1ba86a8b1f3f91d6c7038d3
SHA1

5269612ca00012955f3a4de1c7a01d1b48e5f722
SHA256

6e5a6f5092c1fcdc47ca8a4236a3ae49398226a40f1c0c321faddc791b1196e9
SHA512

54a6c7856d5d3ccb424d5b39c657ff2408796ea85552eca26e7e6bbe84304b3eb9166a62ea8f3842f94dc4c0ad590b442a37357a43286ec1725862681f5d7e6d
SSDEEP

6144:MtpickMsrZSHFDQQfHFYefErVhNAuEU0wX/WKaGnIB7SHBrDe/QxhR/WTEouyRCk:MtRBlJYefKVhNpzPWupFaiHGB

Score

1^/10

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1228	1204	key_panda.exe	27
PID 1204 wrote to memory of 1228	1204	key_panda.exe	27
PID 1204 wrote to memory of 1228	1204	key_panda.exe	27
PID 1204 wrote to memory of 1228	1204	key_panda.exe	27
PID 1204 wrote to memory of 840	1204	key_panda.exe	28
PID 1204 wrote to memory of 840	1204	key_panda.exe	28
PID 1204 wrote to memory of 840	1204	key_panda.exe	28
PID 1204 wrote to memory of 840	1204	key_panda.exe	28

C:\Users\Admin\AppData\Local\Temp\key_panda.exe
"C:\Users\Admin\AppData\Local\Temp\key_panda.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Users\Admin\AppData\Local\Temp\key_panda.exe
  start
  2⤵
  PID:1228
- C:\Users\Admin\AppData\Local\Temp\key_panda.exe
  watch
  2⤵
  PID:840

memory/840-60-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/840-63-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1204-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/1204-59-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1228-61-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1228-62-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download