0a09f5502391570ad96a4a329c387bb4487f6727c2139b2d9800e3e4e65bf681

Analysis

max time kernel
39s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 10:11

Target

terraria_v1_2_3_tfile_ru.exe
Size

525KB
MD5

fc926ae2c29db25a15b51f0e86fc6d7d
SHA1

b99a940f0c466f2e08ab36c81b810d8e080a5cb3
SHA256

292fc4e26c1bb68f382fa5f2778d5131a1c6e3011466ab879c447b95d07890ca
SHA512

14bbca1ff089d88187fd732ec23c671e3d27dc12505a5d8be7407ff70156ebb0e8c505488c6d3a3a7508cad3c9bb6d1e545640eab30dba14ebd9a2f86dafa99c
SSDEEP

6144:P2ZCRGfEUv988zB21s+ccxNy32PbLv7+GusRN+ax34v0/QU3p7nuY+QBI0EUIP6U:P2ZFDUxPPnusG2jYQL6n0xA

Score

1^/10

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1476	1504	terraria_v1_2_3_tfile_ru.exe	26
PID 1504 wrote to memory of 1476	1504	terraria_v1_2_3_tfile_ru.exe	26
PID 1504 wrote to memory of 1476	1504	terraria_v1_2_3_tfile_ru.exe	26
PID 1504 wrote to memory of 1476	1504	terraria_v1_2_3_tfile_ru.exe	26
PID 1504 wrote to memory of 1336	1504	terraria_v1_2_3_tfile_ru.exe	27
PID 1504 wrote to memory of 1336	1504	terraria_v1_2_3_tfile_ru.exe	27
PID 1504 wrote to memory of 1336	1504	terraria_v1_2_3_tfile_ru.exe	27
PID 1504 wrote to memory of 1336	1504	terraria_v1_2_3_tfile_ru.exe	27

C:\Users\Admin\AppData\Local\Temp\terraria_v1_2_3_tfile_ru.exe
"C:\Users\Admin\AppData\Local\Temp\terraria_v1_2_3_tfile_ru.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Users\Admin\AppData\Local\Temp\terraria_v1_2_3_tfile_ru.exe
  start
  2⤵
  PID:1476
- C:\Users\Admin\AppData\Local\Temp\terraria_v1_2_3_tfile_ru.exe
  watch
  2⤵
  PID:1336

memory/1336-57-0x0000000000000000-mapping.dmp

Download
memory/1336-62-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1336-64-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1476-56-0x0000000000000000-mapping.dmp

Download
memory/1476-61-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1476-63-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1504-54-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download
memory/1504-55-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1504-60-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download