bbc919c6b1f9e1e912aee647332ece2fdcb2dd285ec5539858c3c0256e89d3f9

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 18:56

Target

bbc919c6b1f9e1e912aee647332ece2fdcb2dd285ec5539858c3c0256e89d3f9.exe
Size

541KB
MD5

503a01301afd503c86af5e45313f5103
SHA1

cc9fffc899cd8c22a14e0120601acf03f1013463
SHA256

bbc919c6b1f9e1e912aee647332ece2fdcb2dd285ec5539858c3c0256e89d3f9
SHA512

2992fcaf99fa0c9732e1695d3ae3f70a0e22bc3145bfd86886866cf447f943149f8a05982d8f1530d66ec88f7ff7a6ecbb646c9e02116f8d50b477545e1d3a36
SSDEEP

12288:/ZL4UXvAQrpgTHWJaG/egs46iWOctlVQv2/UF:RL4UfGWb0/rBlVQv2sF

Score

1^/10

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 1748	1552	bbc919c6b1f9e1e912aee647332ece2fdcb2dd285ec5539858c3c0256e89d3f9.exe	26
PID 1552 wrote to memory of 1748	1552	bbc919c6b1f9e1e912aee647332ece2fdcb2dd285ec5539858c3c0256e89d3f9.exe	26
PID 1552 wrote to memory of 1748	1552	bbc919c6b1f9e1e912aee647332ece2fdcb2dd285ec5539858c3c0256e89d3f9.exe	26
PID 1552 wrote to memory of 1748	1552	bbc919c6b1f9e1e912aee647332ece2fdcb2dd285ec5539858c3c0256e89d3f9.exe	26
PID 1552 wrote to memory of 1464	1552	bbc919c6b1f9e1e912aee647332ece2fdcb2dd285ec5539858c3c0256e89d3f9.exe	27
PID 1552 wrote to memory of 1464	1552	bbc919c6b1f9e1e912aee647332ece2fdcb2dd285ec5539858c3c0256e89d3f9.exe	27
PID 1552 wrote to memory of 1464	1552	bbc919c6b1f9e1e912aee647332ece2fdcb2dd285ec5539858c3c0256e89d3f9.exe	27
PID 1552 wrote to memory of 1464	1552	bbc919c6b1f9e1e912aee647332ece2fdcb2dd285ec5539858c3c0256e89d3f9.exe	27

C:\Users\Admin\AppData\Local\Temp\bbc919c6b1f9e1e912aee647332ece2fdcb2dd285ec5539858c3c0256e89d3f9.exe
"C:\Users\Admin\AppData\Local\Temp\bbc919c6b1f9e1e912aee647332ece2fdcb2dd285ec5539858c3c0256e89d3f9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Users\Admin\AppData\Local\Temp\bbc919c6b1f9e1e912aee647332ece2fdcb2dd285ec5539858c3c0256e89d3f9.exe
  start
  2⤵
  PID:1748
- C:\Users\Admin\AppData\Local\Temp\bbc919c6b1f9e1e912aee647332ece2fdcb2dd285ec5539858c3c0256e89d3f9.exe
  watch
  2⤵
  PID:1464

memory/1464-61-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1464-63-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1552-54-0x0000000075681000-0x0000000075683000-memory.dmp

Filesize
8KB

Download
memory/1552-59-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1748-60-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1748-62-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download