b3c45a636fbb907b7a96dc9bb2986f698ca375524c61507a5fe414a940f72b16

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
30-10-2023 05:46

Target

file.exe
Size

367KB
MD5

4fd9426e87355c0c15b1d2214720a273
SHA1

e885e94d35df088ace24031f9e6822ac81c5506d
SHA256

b3c45a636fbb907b7a96dc9bb2986f698ca375524c61507a5fe414a940f72b16
SHA512

a25f7a9a5c8afc221a8f9151c2cf3ff2c500cd8d78f000dba47562a4e19d0d421ebc33dd1e50fde553325c6ca47849ee4c4905c389ba1fa9a1c7e9bd70ab346f
SSDEEP

6144:IKOazRkw8kJbjgehnX3Zosnp5eZf5TB/5a2pzenmeYOtYYE2Odtyqd72fgQQD:IKOazV8ojgehX3Zwf5TB/5aozenmZlYw

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

file.exe

description	pid	process	target process
PID 2288 wrote to memory of 2140	2288	file.exe	file.exe
PID 2288 wrote to memory of 2140	2288	file.exe	file.exe
PID 2288 wrote to memory of 2140	2288	file.exe	file.exe
PID 2288 wrote to memory of 2140	2288	file.exe	file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2288

C:\Users\Admin\AppData\Local\Temp\file.exe
C:\Users\Admin\AppData\Local\Temp\file.exe
2⤵
PID:2140

memory/2288-0-0x0000000000960000-0x00000000009C0000-memory.dmp

Filesize
384KB

Download
memory/2288-1-0x0000000074A70000-0x000000007515E000-memory.dmp

Filesize
6.9MB

Download
memory/2288-2-0x0000000001FF0000-0x0000000002044000-memory.dmp

Filesize
336KB

Download
memory/2288-3-0x00000000049E0000-0x0000000004A20000-memory.dmp

Filesize
256KB

Download
memory/2288-4-0x00000000003E0000-0x00000000003EA000-memory.dmp

Filesize
40KB

Download
memory/2288-5-0x0000000074A70000-0x000000007515E000-memory.dmp

Filesize
6.9MB

Download