6e3dc42b43bb64359a5871df9a0c1cbfc4c06c366009ee24ad7150672ec1331b

Analysis

max time kernel
112s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 10:09

Target

marinina_tfile_ru.exe
Size

525KB
MD5

6e26ad3279c937818dea9d07b9d35a12
SHA1

65519c205719ce2924b98580692a80986184cc07
SHA256

58fe1a9f29576a95bc85aa4f66a7b4bfaa48d873bf7adf8945dc64ce54628b40
SHA512

3b0f7442102d279ebc2aa1b4bcd0fa8e98c8fd8494eaeca60bbf2f8c15d8d32108d7087018cef6f22b399b5932240d1ef307b91c2cf4305b5041c9d86228ce90
SSDEEP

6144:m2Zxo+cqn7xmB95vDRDuBLeQ81jxg140w6NYxwKpHetWZtJXwciSf7JBI0EUIP6P:m2ZtOKMjxg1lwcM+t0XwU6004

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 4780	1516	marinina_tfile_ru.exe	81
PID 1516 wrote to memory of 4780	1516	marinina_tfile_ru.exe	81
PID 1516 wrote to memory of 4780	1516	marinina_tfile_ru.exe	81
PID 1516 wrote to memory of 2168	1516	marinina_tfile_ru.exe	82
PID 1516 wrote to memory of 2168	1516	marinina_tfile_ru.exe	82
PID 1516 wrote to memory of 2168	1516	marinina_tfile_ru.exe	82

C:\Users\Admin\AppData\Local\Temp\marinina_tfile_ru.exe
"C:\Users\Admin\AppData\Local\Temp\marinina_tfile_ru.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Users\Admin\AppData\Local\Temp\marinina_tfile_ru.exe
  start
  2⤵
  PID:4780
- C:\Users\Admin\AppData\Local\Temp\marinina_tfile_ru.exe
  watch
  2⤵
  PID:2168

memory/1516-134-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2168-136-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2168-138-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/4780-135-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/4780-137-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download