b471ee5e875003b428faf848e504643e10187b7fb6f95be55010060538add906

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
03-11-2023 05:39

Target

b471ee5e875003b428faf848e504643e10187b7fb6f95be55010060538add906.exe
Size

48KB
MD5

c88cd660c9814edb7573b69b02db3ba3
SHA1

34ced1c3603badcf4ffddc97621fe4810f4f0807
SHA256

b471ee5e875003b428faf848e504643e10187b7fb6f95be55010060538add906
SHA512

6ba69d96d868a151a882e3175951d48bda63b2e1bb71f7a9d7ded129cbb6b4eefb877bc88938baad27577b738766730c140c3136c4a428c3c614cfb99d45fc06
SSDEEP

768:ndV0MxpFjIRc7Yu+4O36YO+eNfcF4Soker6qQ4HyWOPHxT+scX2v:ndV0MssVPYOjNfcqJgqxOZcG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

b471ee5e875003b428faf848e504643e10187b7fb6f95be55010060538add906.exe

description	pid	process	target process
PID 1940 wrote to memory of 1704	1940	b471ee5e875003b428faf848e504643e10187b7fb6f95be55010060538add906.exe	cmd.exe
PID 1940 wrote to memory of 1704	1940	b471ee5e875003b428faf848e504643e10187b7fb6f95be55010060538add906.exe	cmd.exe
PID 1940 wrote to memory of 1704	1940	b471ee5e875003b428faf848e504643e10187b7fb6f95be55010060538add906.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\b471ee5e875003b428faf848e504643e10187b7fb6f95be55010060538add906.exe
"C:\Users\Admin\AppData\Local\Temp\b471ee5e875003b428faf848e504643e10187b7fb6f95be55010060538add906.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1940

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c start excel.exe Èý·½ÈËÍ³¼ÆÄ£°å-20232202.xlsx
2⤵
PID:1704

memory/1940-0-0x000000013FF80000-0x000000013FF90000-memory.dmp

Filesize
64KB

Download
memory/1940-1-0x000000013FF80000-0x000000013FF90000-memory.dmp

Filesize
64KB

Download