b39f6567cb3f47966807f4cf6b09c3528bf87d34ef857055ee2bea8ab0cd91b8

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 14:57

Target

b39f6567cb3f47966807f4cf6b09c3528bf87d34ef857055ee2bea8ab0cd91b8.exe
Size

2.8MB
MD5

b268c79abe2d164031f2da5dc2ca41c1
SHA1

a3b76614d7570db042f784402c06ce0aebb23be6
SHA256

b39f6567cb3f47966807f4cf6b09c3528bf87d34ef857055ee2bea8ab0cd91b8
SHA512

83e62a8c613d3a78849ead701b82569dcb43c92a45ef96ec6b1464282ab65bdfa0b9f1b90259ee5e57f15e61593ee2ab1f935d21099012cd7a4e3ddeb85b8166
SSDEEP

49152:ylY613tTF8JtoWWDvDruZiNJrzgAczZe4CbAFlePs1IrNugj4lymG7+gZd:ylAtWDvPNZgZzZe4CRc68l9AZd

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 1620	1196	b39f6567cb3f47966807f4cf6b09c3528bf87d34ef857055ee2bea8ab0cd91b8.exe	27
PID 1196 wrote to memory of 1620	1196	b39f6567cb3f47966807f4cf6b09c3528bf87d34ef857055ee2bea8ab0cd91b8.exe	27
PID 1196 wrote to memory of 1620	1196	b39f6567cb3f47966807f4cf6b09c3528bf87d34ef857055ee2bea8ab0cd91b8.exe	27
PID 1196 wrote to memory of 1620	1196	b39f6567cb3f47966807f4cf6b09c3528bf87d34ef857055ee2bea8ab0cd91b8.exe	27
PID 1196 wrote to memory of 1620	1196	b39f6567cb3f47966807f4cf6b09c3528bf87d34ef857055ee2bea8ab0cd91b8.exe	27
PID 1196 wrote to memory of 1620	1196	b39f6567cb3f47966807f4cf6b09c3528bf87d34ef857055ee2bea8ab0cd91b8.exe	27
PID 1196 wrote to memory of 1620	1196	b39f6567cb3f47966807f4cf6b09c3528bf87d34ef857055ee2bea8ab0cd91b8.exe	27
PID 1620 wrote to memory of 1100	1620	Net.exe	29
PID 1620 wrote to memory of 1100	1620	Net.exe	29
PID 1620 wrote to memory of 1100	1620	Net.exe	29
PID 1620 wrote to memory of 1100	1620	Net.exe	29
PID 1620 wrote to memory of 1100	1620	Net.exe	29
PID 1620 wrote to memory of 1100	1620	Net.exe	29
PID 1620 wrote to memory of 1100	1620	Net.exe	29

C:\Users\Admin\AppData\Local\Temp\b39f6567cb3f47966807f4cf6b09c3528bf87d34ef857055ee2bea8ab0cd91b8.exe
"C:\Users\Admin\AppData\Local\Temp\b39f6567cb3f47966807f4cf6b09c3528bf87d34ef857055ee2bea8ab0cd91b8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\SysWOW64\Net.exe
  Net Stop PcaSvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 Stop PcaSvc
    3⤵
    PID:1100

memory/1196-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download