4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168

Analysis

max time kernel
24s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 01:54

Target

4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168.exe
Size

488KB
MD5

e894630e1936e2e7775740c13fa2b38a
SHA1

2586adda22521e01b0dfb66468e54fb951fffdc0
SHA256

4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168
SHA512

1552c864e3f02837270fbca634e489e084a59ff25a9ee1292a55b17b1226837764ae480bbee638b77f3695406e7de04556cd5b9d453a950c883111375694bab8
SSDEEP

6144:2XwfGPzw9AN58A4z8GYOinammngNp1V98U3/E3FA/zY9UdrIdn+iudYAMpxka0Oy:2gfGEHz8xRazgNgUvE3uECleAMpxkRE8

Score

1^/10

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168.exe

description	pid	process	target process
PID 328 wrote to memory of 1152	328	4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168.exe	4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168.exe
PID 328 wrote to memory of 1152	328	4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168.exe	4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168.exe
PID 328 wrote to memory of 1152	328	4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168.exe	4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168.exe
PID 328 wrote to memory of 1152	328	4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168.exe	4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168.exe
PID 328 wrote to memory of 2040	328	4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168.exe	4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168.exe
PID 328 wrote to memory of 2040	328	4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168.exe	4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168.exe
PID 328 wrote to memory of 2040	328	4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168.exe	4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168.exe
PID 328 wrote to memory of 2040	328	4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168.exe	4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168.exe

C:\Users\Admin\AppData\Local\Temp\4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168.exe
"C:\Users\Admin\AppData\Local\Temp\4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:328

C:\Users\Admin\AppData\Local\Temp\4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168.exe
start
2⤵
PID:1152

C:\Users\Admin\AppData\Local\Temp\4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168.exe
watch
2⤵
PID:2040

memory/328-54-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

Filesize
8KB

Download
memory/328-59-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1152-55-0x0000000000000000-mapping.dmp

Download
memory/1152-61-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1152-63-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1152-64-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2040-56-0x0000000000000000-mapping.dmp

Download
memory/2040-60-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2040-62-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2040-65-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download