28dca3b6181033b3597d0be7e154fd72e7e1c9bbc29bbabb4614bc47bf1f2993

Analysis

max time kernel
21s
max time network
107s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 16:02

Target

dexter_s08_tfile_ru.exe
Size

507KB
MD5

7033ae4844152ce7b6bbb1118b1a2258
SHA1

7c0398e1610ad5a02267cc1e741087edd556c5d8
SHA256

2aa82e918e80ded05bda3dad1b820aedfa3f35ace75c9ec7d3ca846fcdb97f35
SHA512

e5983b5f27acee4ad662ad1a7afb47c044a80b57018d2ee081d5c5697aa1a9c0ce63375029d762f3dc200d077d838a7dae405686fb00fa05d8d3347a74b46b8a
SSDEEP

6144:4x5P5mG/ZvU052Dr9Mllfo2HLeLVjJ2lHCarIC/qFeCzIcN5fcFkJrYLW:c5Z/ZM0gdnmWjwhCwqFbz45LW

Score

1^/10

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 1320	1360	dexter_s08_tfile_ru.exe	28
PID 1360 wrote to memory of 1320	1360	dexter_s08_tfile_ru.exe	28
PID 1360 wrote to memory of 1320	1360	dexter_s08_tfile_ru.exe	28
PID 1360 wrote to memory of 1320	1360	dexter_s08_tfile_ru.exe	28
PID 1360 wrote to memory of 956	1360	dexter_s08_tfile_ru.exe	29
PID 1360 wrote to memory of 956	1360	dexter_s08_tfile_ru.exe	29
PID 1360 wrote to memory of 956	1360	dexter_s08_tfile_ru.exe	29
PID 1360 wrote to memory of 956	1360	dexter_s08_tfile_ru.exe	29

C:\Users\Admin\AppData\Local\Temp\dexter_s08_tfile_ru.exe
"C:\Users\Admin\AppData\Local\Temp\dexter_s08_tfile_ru.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Users\Admin\AppData\Local\Temp\dexter_s08_tfile_ru.exe
  start
  2⤵
  PID:1320
- C:\Users\Admin\AppData\Local\Temp\dexter_s08_tfile_ru.exe
  watch
  2⤵
  PID:956

memory/956-61-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/956-65-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1320-62-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1320-63-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1320-64-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1360-54-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download
memory/1360-55-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1360-60-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download