8d52a1b8e88737efda2c2ffdec7d840a5758dea682d779711aa388ea7028fa46

Analysis

max time kernel
53s
max time network
77s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 23:45

Target

book1257511.exe
Size

506KB
MD5

5fca6b7a4ac12c55b4235fc5d55601d6
SHA1

9844e8601467126111d48d7b3039abb1449d57e4
SHA256

0231babac2f1dddc7d21b3a01dcb272827f7ee41cfaceac8d232b55ca3dc5e1f
SHA512

cc1c45384a666bcd14bfd7209fc58eba119afe407183fdd379b927d2248a1b69b1d7366f88dda081df09847fd87cba1db57edcb398976919b9f0b8d7ab2fd8aa
SSDEEP

6144:5js6I7KzBkEN5gtiwKwtZQ6Gk+Nr6iE1Dmq+Dnqu9u3gancw7/ae/QxhR/WTEous:5oczBXHwKwMrk+NwgDqYav7niHG5

Score

1^/10

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 1004	1152	book1257511.exe	29
PID 1152 wrote to memory of 1004	1152	book1257511.exe	29
PID 1152 wrote to memory of 1004	1152	book1257511.exe	29
PID 1152 wrote to memory of 1004	1152	book1257511.exe	29
PID 1152 wrote to memory of 1144	1152	book1257511.exe	28
PID 1152 wrote to memory of 1144	1152	book1257511.exe	28
PID 1152 wrote to memory of 1144	1152	book1257511.exe	28
PID 1152 wrote to memory of 1144	1152	book1257511.exe	28

C:\Users\Admin\AppData\Local\Temp\book1257511.exe
"C:\Users\Admin\AppData\Local\Temp\book1257511.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Users\Admin\AppData\Local\Temp\book1257511.exe
  watch
  2⤵
  PID:1144
- C:\Users\Admin\AppData\Local\Temp\book1257511.exe
  start
  2⤵
  PID:1004

memory/1004-61-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1004-63-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1004-65-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1144-62-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1144-64-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1144-66-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1152-54-0x0000000075881000-0x0000000075883000-memory.dmp

Filesize
8KB

Download
memory/1152-55-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1152-60-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download