6999f6ee47b734222933293db302861cc9949c8cff87eb59a1ebf99b8af8df51

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 01:07

Target

22903d51860406029889f4e431cbbe29.exe
Size

65KB
MD5

22903d51860406029889f4e431cbbe29
SHA1

c6092a9bfb97d44e80c783d5efc3265c9b5f4d26
SHA256

6999f6ee47b734222933293db302861cc9949c8cff87eb59a1ebf99b8af8df51
SHA512

d99c7d3f1c36d4a026a3b33827e567c376109bc1d397763b36eaf0fbe6ab5178249eb54d5427e0ca2fcb4f1cb325195909899ec34b78cfb22a7168696c7bc798
SSDEEP

768:apV2VcdAF/egBcz5XyDO/SSrpy8mXRA2iUpcQimdLNjHAqGrXNZqa+Yw1bLCIg:avzcKNXB/JaWApJMqiXN3wNL

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system\e425827c.fon	22903d51860406029889f4e431cbbe29.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 1968	1656	22903d51860406029889f4e431cbbe29.exe	14
PID 1656 wrote to memory of 1968	1656	22903d51860406029889f4e431cbbe29.exe	14
PID 1656 wrote to memory of 1968	1656	22903d51860406029889f4e431cbbe29.exe	14
PID 1656 wrote to memory of 1968	1656	22903d51860406029889f4e431cbbe29.exe	14

C:\Users\Admin\AppData\Local\Temp\22903d51860406029889f4e431cbbe29.exe
C:\Users\Admin\AppData\Local\Temp\22903d51860406029889f4e431cbbe29.exe
1⤵
- Drops file in Windows directory
PID:1968

C:\Users\Admin\AppData\Local\Temp\22903d51860406029889f4e431cbbe29.exe
"C:\Users\Admin\AppData\Local\Temp\22903d51860406029889f4e431cbbe29.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1656

memory/1656-1-0x0000000000020000-0x0000000000033000-memory.dmp

Filesize
76KB

Download
memory/1656-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1968-3-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download