2aab2114377f298cb421591d4645d607121cb061da7e9c54093121dccaeb5914

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 05:26

Target

2aab2114377f298cb421591d4645d607121cb061da7e9c54093121dccaeb5914.exe
Size

2.2MB
MD5

3c62ee440f0e52388663364685fa7d45
SHA1

553bf5017dace325b9cc6121c0fa412f7e60bc4d
SHA256

2aab2114377f298cb421591d4645d607121cb061da7e9c54093121dccaeb5914
SHA512

cc7da20cf37ab27685e1f6715f958ca8026b4babcd5c9806f3b1e89170065f7c1ebb24b798c96a91e85558b74dcaba671337d360305ced5b983859ce7345280e
SSDEEP

49152:ylY6132TFIM8zu2yxDVLKPDiiyAOnsnh/XX4idCz2N+b:yluxxDVLM+i/h/R42q

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 1252	1768	2aab2114377f298cb421591d4645d607121cb061da7e9c54093121dccaeb5914.exe	27
PID 1768 wrote to memory of 1252	1768	2aab2114377f298cb421591d4645d607121cb061da7e9c54093121dccaeb5914.exe	27
PID 1768 wrote to memory of 1252	1768	2aab2114377f298cb421591d4645d607121cb061da7e9c54093121dccaeb5914.exe	27
PID 1768 wrote to memory of 1252	1768	2aab2114377f298cb421591d4645d607121cb061da7e9c54093121dccaeb5914.exe	27
PID 1768 wrote to memory of 1252	1768	2aab2114377f298cb421591d4645d607121cb061da7e9c54093121dccaeb5914.exe	27
PID 1768 wrote to memory of 1252	1768	2aab2114377f298cb421591d4645d607121cb061da7e9c54093121dccaeb5914.exe	27
PID 1768 wrote to memory of 1252	1768	2aab2114377f298cb421591d4645d607121cb061da7e9c54093121dccaeb5914.exe	27
PID 1252 wrote to memory of 840	1252	Net.exe	29
PID 1252 wrote to memory of 840	1252	Net.exe	29
PID 1252 wrote to memory of 840	1252	Net.exe	29
PID 1252 wrote to memory of 840	1252	Net.exe	29
PID 1252 wrote to memory of 840	1252	Net.exe	29
PID 1252 wrote to memory of 840	1252	Net.exe	29
PID 1252 wrote to memory of 840	1252	Net.exe	29

C:\Users\Admin\AppData\Local\Temp\2aab2114377f298cb421591d4645d607121cb061da7e9c54093121dccaeb5914.exe
"C:\Users\Admin\AppData\Local\Temp\2aab2114377f298cb421591d4645d607121cb061da7e9c54093121dccaeb5914.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\Net.exe
  Net Stop PcaSvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 Stop PcaSvc
    3⤵
    PID:840

memory/1768-54-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download