8d52a1b8e88737efda2c2ffdec7d840a5758dea682d779711aa388ea7028fa46

Analysis

max time kernel
62s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 23:45

Target

book1257511.exe
Size

506KB
MD5

5fca6b7a4ac12c55b4235fc5d55601d6
SHA1

9844e8601467126111d48d7b3039abb1449d57e4
SHA256

0231babac2f1dddc7d21b3a01dcb272827f7ee41cfaceac8d232b55ca3dc5e1f
SHA512

cc1c45384a666bcd14bfd7209fc58eba119afe407183fdd379b927d2248a1b69b1d7366f88dda081df09847fd87cba1db57edcb398976919b9f0b8d7ab2fd8aa
SSDEEP

6144:5js6I7KzBkEN5gtiwKwtZQ6Gk+Nr6iE1Dmq+Dnqu9u3gancw7/ae/QxhR/WTEous:5oczBXHwKwMrk+NwgDqYav7niHG5

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 4928	1960	book1257511.exe	81
PID 1960 wrote to memory of 4928	1960	book1257511.exe	81
PID 1960 wrote to memory of 4928	1960	book1257511.exe	81
PID 1960 wrote to memory of 4908	1960	book1257511.exe	82
PID 1960 wrote to memory of 4908	1960	book1257511.exe	82
PID 1960 wrote to memory of 4908	1960	book1257511.exe	82

C:\Users\Admin\AppData\Local\Temp\book1257511.exe
"C:\Users\Admin\AppData\Local\Temp\book1257511.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Users\Admin\AppData\Local\Temp\book1257511.exe
  start
  2⤵
  PID:4928
- C:\Users\Admin\AppData\Local\Temp\book1257511.exe
  watch
  2⤵
  PID:4908

memory/1960-134-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4908-135-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4908-138-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4928-136-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4928-137-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download