5220d86c4158b06340cc76b9e18eb6aeb56e427a81577d6f90f24d54a720ddbf

Analysis

max time kernel
27s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 15:44

Target

5220d86c4158b06340cc76b9e18eb6aeb56e427a81577d6f90f24d54a720ddbf.exe
Size

75KB
MD5

7a7ca30625f27e6a5b329c2581a2f65c
SHA1

ba55242380a2387fabc008f925b70aa903c7f2d3
SHA256

5220d86c4158b06340cc76b9e18eb6aeb56e427a81577d6f90f24d54a720ddbf
SHA512

8f50c97efd6a3b53b305f5bf84bf9fb16b98cfaf79e851a2a5a6a945144af3c67451854345621b9634ee4aeb92881aa25d0cbb0606b8b410dabad0a174e7ea4b
SSDEEP

1536:Nj8d0rHjiifOBqvUlEhHJcdNEGm6DjIAJBV3L+lfDTw:Nj8d0viifO+hHJcDEGm6ooBkw

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1892	2004	5220d86c4158b06340cc76b9e18eb6aeb56e427a81577d6f90f24d54a720ddbf.exe	28
PID 2004 wrote to memory of 1892	2004	5220d86c4158b06340cc76b9e18eb6aeb56e427a81577d6f90f24d54a720ddbf.exe	28
PID 2004 wrote to memory of 1892	2004	5220d86c4158b06340cc76b9e18eb6aeb56e427a81577d6f90f24d54a720ddbf.exe	28
PID 2004 wrote to memory of 1892	2004	5220d86c4158b06340cc76b9e18eb6aeb56e427a81577d6f90f24d54a720ddbf.exe	28

C:\Users\Admin\AppData\Local\Temp\5220d86c4158b06340cc76b9e18eb6aeb56e427a81577d6f90f24d54a720ddbf.exe
"C:\Users\Admin\AppData\Local\Temp\5220d86c4158b06340cc76b9e18eb6aeb56e427a81577d6f90f24d54a720ddbf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Users\Admin\AppData\Local\Temp\5220d86c4158b06340cc76b9e18eb6aeb56e427a81577d6f90f24d54a720ddbf.exe
  ?
  2⤵
  PID:1892

memory/1892-55-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download
memory/1892-56-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download