b6aa7b0b926207840636002c8bfaa6fba824a6c4376746ee595e5f1026b08849

Analysis

max time kernel
152s
max time network
166s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 14:43

Target

b6aa7b0b926207840636002c8bfaa6fba824a6c4376746ee595e5f1026b08849.exe
Size

244KB
MD5

6589356a55d532a851a580cbc1aac99c
SHA1

ae9fccf8ab12693e067e72302ab07b2ef8b8e3d7
SHA256

b6aa7b0b926207840636002c8bfaa6fba824a6c4376746ee595e5f1026b08849
SHA512

b6925bd300bde51e194387f67503bde3fd5aced835c8c49ccb40e13b62888f6568ca4630c00fa479079eacada393179caf54775bf09d16db6af63de373030ea6
SSDEEP

6144:711Ae347ppLQAyJJgskpjBGW9Js2YuXQdO5L1Zsvfm:nr34jY2sYBR7dn1svfm

Score

1^/10

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1880	b6aa7b0b926207840636002c8bfaa6fba824a6c4376746ee595e5f1026b08849.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 1152	1880	b6aa7b0b926207840636002c8bfaa6fba824a6c4376746ee595e5f1026b08849.exe	27
PID 1880 wrote to memory of 1152	1880	b6aa7b0b926207840636002c8bfaa6fba824a6c4376746ee595e5f1026b08849.exe	27
PID 1880 wrote to memory of 1152	1880	b6aa7b0b926207840636002c8bfaa6fba824a6c4376746ee595e5f1026b08849.exe	27
PID 1880 wrote to memory of 1152	1880	b6aa7b0b926207840636002c8bfaa6fba824a6c4376746ee595e5f1026b08849.exe	27
PID 1880 wrote to memory of 1152	1880	b6aa7b0b926207840636002c8bfaa6fba824a6c4376746ee595e5f1026b08849.exe	27
PID 1880 wrote to memory of 1152	1880	b6aa7b0b926207840636002c8bfaa6fba824a6c4376746ee595e5f1026b08849.exe	27
PID 1880 wrote to memory of 1152	1880	b6aa7b0b926207840636002c8bfaa6fba824a6c4376746ee595e5f1026b08849.exe	27

memory/1152-54-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/1152-56-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/1152-59-0x0000000000140000-0x0000000000148000-memory.dmp

Filesize
32KB

Download
memory/1152-60-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/1152-61-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/1880-58-0x0000000000320000-0x0000000000334000-memory.dmp

Filesize
80KB

Download