8e749238670b3046f5538e0f78b8b451e2c94bb4d378e56210960ccb4b4e5dbd

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
04-11-2023 11:51

Target

OoklaServer.exe
Size

5.6MB
MD5

1a6e9da331fb622623f10d93273b65dc
SHA1

bd0bdf54aeba4361fafbb535c88ce9b6c7b1abd7
SHA256

8e749238670b3046f5538e0f78b8b451e2c94bb4d378e56210960ccb4b4e5dbd
SHA512

3bd75370a992bc21c9c51dab99b3a624a3f0017beb7ce85b5b9ddaafa2ce600e6baff2b66a391eb97d87a3ada2c167be1aae37af13308852ae266921ac54d070
SSDEEP

49152:9fVwASOwGtlqPqIU6iZOeOGCzQS/prEGqr7CNH2work9swJU5FVvTxV4DwYEQsg9:+9+Hm/RewJoj1sqt0QEE2kBUIwpE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2232	1728	OoklaServer.exe	29
PID 1728 wrote to memory of 2232	1728	OoklaServer.exe	29
PID 1728 wrote to memory of 2232	1728	OoklaServer.exe	29

C:\Users\Admin\AppData\Local\Temp\OoklaServer.exe
"C:\Users\Admin\AppData\Local\Temp\OoklaServer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Users\Admin\AppData\Local\Temp\OoklaServer.exe
  C:\Users\Admin\AppData\Local\Temp\OoklaServer.exe /ward --server-id=cd86066a-6222-4c92-9a83-28c3b8251790
  2⤵
  PID:2232