b6815f104a94e4026b6b35841218d21d0f8bba89f407aae9c249da011a56eb82

Analysis

max time kernel
27s
max time network
63s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 09:58

Target

b6815f104a94e4026b6b35841218d21d0f8bba89f407aae9c249da011a56eb82.exe
Size

529KB
MD5

61b7ba0dcfc2a348033f37bb8f163423
SHA1

2ae3e7ea51071e3f4bf52e47958cbbfda2f6b747
SHA256

b6815f104a94e4026b6b35841218d21d0f8bba89f407aae9c249da011a56eb82
SHA512

4a2a60fa5295c9dfe6f777de5d756667c558bebd10e948ab16beab3da0e5ae2c7b365d0b3ceafebf21b55c22d9672dcfb5c41ffc3196b706a36ac9207d83bf61
SSDEEP

12288:o2ZHI6n+GpFlITvDEOMu0bqRB4jH6+0g2B:Rt+G/lITv70uRBUZGB

Score

1^/10

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 1000	1960	b6815f104a94e4026b6b35841218d21d0f8bba89f407aae9c249da011a56eb82.exe	28
PID 1960 wrote to memory of 1000	1960	b6815f104a94e4026b6b35841218d21d0f8bba89f407aae9c249da011a56eb82.exe	28
PID 1960 wrote to memory of 1000	1960	b6815f104a94e4026b6b35841218d21d0f8bba89f407aae9c249da011a56eb82.exe	28
PID 1960 wrote to memory of 1000	1960	b6815f104a94e4026b6b35841218d21d0f8bba89f407aae9c249da011a56eb82.exe	28
PID 1960 wrote to memory of 1776	1960	b6815f104a94e4026b6b35841218d21d0f8bba89f407aae9c249da011a56eb82.exe	29
PID 1960 wrote to memory of 1776	1960	b6815f104a94e4026b6b35841218d21d0f8bba89f407aae9c249da011a56eb82.exe	29
PID 1960 wrote to memory of 1776	1960	b6815f104a94e4026b6b35841218d21d0f8bba89f407aae9c249da011a56eb82.exe	29
PID 1960 wrote to memory of 1776	1960	b6815f104a94e4026b6b35841218d21d0f8bba89f407aae9c249da011a56eb82.exe	29

C:\Users\Admin\AppData\Local\Temp\b6815f104a94e4026b6b35841218d21d0f8bba89f407aae9c249da011a56eb82.exe
"C:\Users\Admin\AppData\Local\Temp\b6815f104a94e4026b6b35841218d21d0f8bba89f407aae9c249da011a56eb82.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Users\Admin\AppData\Local\Temp\b6815f104a94e4026b6b35841218d21d0f8bba89f407aae9c249da011a56eb82.exe
  start
  2⤵
  PID:1000
- C:\Users\Admin\AppData\Local\Temp\b6815f104a94e4026b6b35841218d21d0f8bba89f407aae9c249da011a56eb82.exe
  watch
  2⤵
  PID:1776

memory/1000-60-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1000-62-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1776-61-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1776-63-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1960-54-0x0000000076321000-0x0000000076323000-memory.dmp

Filesize
8KB

Download
memory/1960-59-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download