a6760d906368e84ef60cd3ecd91b43aa9dc9c30dc44525cdde6403c70c5f5f09

Analysis

max time kernel
42s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 16:00

Target

a6760d906368e84ef60cd3ecd91b43aa9dc9c30dc44525cdde6403c70c5f5f09.exe
Size

32KB
MD5

4acab00bbec7918e830e853545ac4024
SHA1

c18bd19f3d469d1b936f21f8ed4519a082d85243
SHA256

a6760d906368e84ef60cd3ecd91b43aa9dc9c30dc44525cdde6403c70c5f5f09
SHA512

296896848828b72de782e62b4bf5dad0143f84d057a8dd064992f42931575590b2b4e6acb54ef3b0f03852b347ae2d08d914ce39103f7a7bab91f7e0243b1162
SSDEEP

384:VL4pr21sGFNLTXgUGaSqfGj47XMrskpLNe7IBJEfYqwpG1lWsE4SNVF8HiQN2fE:1uSsGqE/zMxwkfxk1lo4SNMHiQIs

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 2016	1048	a6760d906368e84ef60cd3ecd91b43aa9dc9c30dc44525cdde6403c70c5f5f09.exe	27
PID 1048 wrote to memory of 2016	1048	a6760d906368e84ef60cd3ecd91b43aa9dc9c30dc44525cdde6403c70c5f5f09.exe	27
PID 1048 wrote to memory of 2016	1048	a6760d906368e84ef60cd3ecd91b43aa9dc9c30dc44525cdde6403c70c5f5f09.exe	27
PID 1048 wrote to memory of 2016	1048	a6760d906368e84ef60cd3ecd91b43aa9dc9c30dc44525cdde6403c70c5f5f09.exe	27

C:\Users\Admin\AppData\Local\Temp\a6760d906368e84ef60cd3ecd91b43aa9dc9c30dc44525cdde6403c70c5f5f09.exe
"C:\Users\Admin\AppData\Local\Temp\a6760d906368e84ef60cd3ecd91b43aa9dc9c30dc44525cdde6403c70c5f5f09.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\notepad.exe
  C:\Windows\notepad.exe
  2⤵
  PID:2016

memory/1048-54-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/1048-57-0x0000000074A00000-0x0000000074FAB000-memory.dmp

Filesize
5.7MB

Download
memory/2016-56-0x000007FEFBEE1000-0x000007FEFBEE3000-memory.dmp

Filesize
8KB

Download