5aa09b97eaa26794f023e3df05b583733c4b36d18b8a9c47b160a16cae1f2d01

Analysis

max time kernel
2s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 18:36

Target

5aa09b97eaa26794f023e3df05b583733c4b36d18b8a9c47b160a16cae1f2d01.exe
Size

22KB
MD5

3d052ccbfa4911e3c99be3fe5647dda3
SHA1

16a4de02ecaf5abe2374b44fef976d39f6ccfeaa
SHA256

5aa09b97eaa26794f023e3df05b583733c4b36d18b8a9c47b160a16cae1f2d01
SHA512

84c2ab76076c400e9f710ed717b8442bcf141f41f79d9488e7c61bc154c3637efbd471f3a0ab53213830ef5df25aa899fe176932ef73017c7d1f7c1e6a857b32
SSDEEP

192:g8AaHhlF8CEk3yqlcaG9eowRRJhf7ZQ1H1tLzjyFZrYcCDq:g8V8sCqlcaGPwfJNuN1ZzebrYrW

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 564 wrote to memory of 280	564	5aa09b97eaa26794f023e3df05b583733c4b36d18b8a9c47b160a16cae1f2d01.exe	29
PID 564 wrote to memory of 280	564	5aa09b97eaa26794f023e3df05b583733c4b36d18b8a9c47b160a16cae1f2d01.exe	29
PID 564 wrote to memory of 280	564	5aa09b97eaa26794f023e3df05b583733c4b36d18b8a9c47b160a16cae1f2d01.exe	29
PID 564 wrote to memory of 280	564	5aa09b97eaa26794f023e3df05b583733c4b36d18b8a9c47b160a16cae1f2d01.exe	29

C:\Users\Admin\AppData\Local\Temp\5aa09b97eaa26794f023e3df05b583733c4b36d18b8a9c47b160a16cae1f2d01.exe
"C:\Users\Admin\AppData\Local\Temp\5aa09b97eaa26794f023e3df05b583733c4b36d18b8a9c47b160a16cae1f2d01.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:280