22ea1706aede3e8522e68a3f4a8b672e8578476227e5e8f656991d063e9b7388

Analysis

max time kernel
40s
max time network
55s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 06:46

Target

22ea1706aede3e8522e68a3f4a8b672e8578476227e5e8f656991d063e9b7388.exe
Size

532KB
MD5

9efd573be13b7c73f4a5bdf7cdf9afda
SHA1

f2f849755469f2a6e8c9dd9217f2e4a5c899a5d0
SHA256

22ea1706aede3e8522e68a3f4a8b672e8578476227e5e8f656991d063e9b7388
SHA512

d877ec4d75dc2ab7de346d39938e083bccebf94a877872288a416fa903453bbc342d28683e39bee9988dceed5d6ffa388a1cdf21d1f8bcfd89c66525f9d290d2
SSDEEP

6144:ah0zZuD/2EvVMyDnN8fCZq3blkYABPFpXRtOqaW8LiTf21pDKWwHX5gr47zADAB1:aCaGffPbNwpXRXt8prQzLqnsPuG5c+R

Score

1^/10

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 1952	364	22ea1706aede3e8522e68a3f4a8b672e8578476227e5e8f656991d063e9b7388.exe	26
PID 364 wrote to memory of 1952	364	22ea1706aede3e8522e68a3f4a8b672e8578476227e5e8f656991d063e9b7388.exe	26
PID 364 wrote to memory of 1952	364	22ea1706aede3e8522e68a3f4a8b672e8578476227e5e8f656991d063e9b7388.exe	26
PID 364 wrote to memory of 1952	364	22ea1706aede3e8522e68a3f4a8b672e8578476227e5e8f656991d063e9b7388.exe	26
PID 364 wrote to memory of 1948	364	22ea1706aede3e8522e68a3f4a8b672e8578476227e5e8f656991d063e9b7388.exe	27
PID 364 wrote to memory of 1948	364	22ea1706aede3e8522e68a3f4a8b672e8578476227e5e8f656991d063e9b7388.exe	27
PID 364 wrote to memory of 1948	364	22ea1706aede3e8522e68a3f4a8b672e8578476227e5e8f656991d063e9b7388.exe	27
PID 364 wrote to memory of 1948	364	22ea1706aede3e8522e68a3f4a8b672e8578476227e5e8f656991d063e9b7388.exe	27

C:\Users\Admin\AppData\Local\Temp\22ea1706aede3e8522e68a3f4a8b672e8578476227e5e8f656991d063e9b7388.exe
"C:\Users\Admin\AppData\Local\Temp\22ea1706aede3e8522e68a3f4a8b672e8578476227e5e8f656991d063e9b7388.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:364
- C:\Users\Admin\AppData\Local\Temp\22ea1706aede3e8522e68a3f4a8b672e8578476227e5e8f656991d063e9b7388.exe
  start
  2⤵
  PID:1952
- C:\Users\Admin\AppData\Local\Temp\22ea1706aede3e8522e68a3f4a8b672e8578476227e5e8f656991d063e9b7388.exe
  watch
  2⤵
  PID:1948

memory/364-54-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/364-55-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/364-60-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/1948-57-0x0000000000000000-mapping.dmp

Download
memory/1948-61-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/1948-63-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/1948-66-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/1952-56-0x0000000000000000-mapping.dmp

Download
memory/1952-62-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/1952-64-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/1952-65-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download