0af1466e3a5d21c1c94aeafda8bd6b0ce8e4d15bc87bb779ad50198a298e6365

Analysis

max time kernel
56s
max time network
90s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 06:46

Target

0af1466e3a5d21c1c94aeafda8bd6b0ce8e4d15bc87bb779ad50198a298e6365.exe
Size

56KB
MD5

9de7701ce1ff003b9a39592058106677
SHA1

9faf756a9c3b22006979559f76b3a6f1c857d2c6
SHA256

0af1466e3a5d21c1c94aeafda8bd6b0ce8e4d15bc87bb779ad50198a298e6365
SHA512

402075e75abfd109c39da1f30c038cd248c2520469c9d9a61dabb08c2f2bf7601ac6ccf77085f1f439a3e400d1cd29cb45f700f54212bc84d4958b4bbf148ee5
SSDEEP

1536:XXpCqj8FGWCiBYHuLBwf9lXRhAxPV/NRavVTskg:X5CaiB4AB4lXQx9/NR8W

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 1344	1276	0af1466e3a5d21c1c94aeafda8bd6b0ce8e4d15bc87bb779ad50198a298e6365.exe	28
PID 1276 wrote to memory of 1344	1276	0af1466e3a5d21c1c94aeafda8bd6b0ce8e4d15bc87bb779ad50198a298e6365.exe	28
PID 1276 wrote to memory of 1344	1276	0af1466e3a5d21c1c94aeafda8bd6b0ce8e4d15bc87bb779ad50198a298e6365.exe	28
PID 1276 wrote to memory of 1344	1276	0af1466e3a5d21c1c94aeafda8bd6b0ce8e4d15bc87bb779ad50198a298e6365.exe	28

C:\Users\Admin\AppData\Local\Temp\0af1466e3a5d21c1c94aeafda8bd6b0ce8e4d15bc87bb779ad50198a298e6365.exe
"C:\Users\Admin\AppData\Local\Temp\0af1466e3a5d21c1c94aeafda8bd6b0ce8e4d15bc87bb779ad50198a298e6365.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Users\Admin\AppData\Local\Temp\0af1466e3a5d21c1c94aeafda8bd6b0ce8e4d15bc87bb779ad50198a298e6365.exe
  C:\Users\Admin\AppData\Local\Temp\0af1466e3a5d21c1c" 48
  2⤵
  PID:1344

memory/1276-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/1344-57-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download