5b79def214935c9ffde7a6910172aac0754eadcdfde71fbcc6931666289cef63

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 22:45

Target

fda5bbdf764433bd2975ec985cbf126d.exe
Size

170KB
MD5

fda5bbdf764433bd2975ec985cbf126d
SHA1

be5f50ce30aaa975c561ab0b5dcfed274b78c9c8
SHA256

5b79def214935c9ffde7a6910172aac0754eadcdfde71fbcc6931666289cef63
SHA512

994b8855c7081e50f8d2d628ee0aa5e515fef12ed24db47166416e68bb96c7b00728b8b4820b7d164651bc351db29775fb4940ca375f6779419247d8fd672abc
SSDEEP

3072:gcjbxcTHmyg7UK0wbyj+lMZuybXFS9JoNCG+ajcqeFCpBUcaudEGJVgIk:16ay+0wbyRLYu/rjzeFqWzudEGJVg3

Score

1^/10

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2708	2512	fda5bbdf764433bd2975ec985cbf126d.exe	22
PID 2512 wrote to memory of 2708	2512	fda5bbdf764433bd2975ec985cbf126d.exe	22
PID 2512 wrote to memory of 2708	2512	fda5bbdf764433bd2975ec985cbf126d.exe	22
PID 2512 wrote to memory of 2708	2512	fda5bbdf764433bd2975ec985cbf126d.exe	22
PID 2708 wrote to memory of 2928	2708	net.exe	23
PID 2708 wrote to memory of 2928	2708	net.exe	23
PID 2708 wrote to memory of 2928	2708	net.exe	23
PID 2708 wrote to memory of 2928	2708	net.exe	23
PID 2512 wrote to memory of 2848	2512	fda5bbdf764433bd2975ec985cbf126d.exe	33
PID 2512 wrote to memory of 2848	2512	fda5bbdf764433bd2975ec985cbf126d.exe	33
PID 2512 wrote to memory of 2848	2512	fda5bbdf764433bd2975ec985cbf126d.exe	33
PID 2512 wrote to memory of 2848	2512	fda5bbdf764433bd2975ec985cbf126d.exe	33
PID 2848 wrote to memory of 2908	2848	net.exe	32
PID 2848 wrote to memory of 2908	2848	net.exe	32
PID 2848 wrote to memory of 2908	2848	net.exe	32
PID 2848 wrote to memory of 2908	2848	net.exe	32

C:\Users\Admin\AppData\Local\Temp\fda5bbdf764433bd2975ec985cbf126d.exe
"C:\Users\Admin\AppData\Local\Temp\fda5bbdf764433bd2975ec985cbf126d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\net.exe
  net stop wscsvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop wscsvc
    3⤵
    PID:2928
- C:\Windows\SysWOW64\net.exe
  net stop SharedAccess
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2848

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SharedAccess
1⤵
PID:2908

memory/2512-0-0x00000000002B0000-0x00000000002B4000-memory.dmp

Filesize
16KB

Download
memory/2512-1-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2512-3-0x00000000002B0000-0x00000000002B4000-memory.dmp

Filesize
16KB

Download
memory/2512-2-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download