050d2dd1b332f3f22ab3b00a3f144aad964b963bec942c20926b4892a8428e60

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 21:16

Target

47320f9582fbd915b4714a843a0cde92.exe
Size

589KB
MD5

47320f9582fbd915b4714a843a0cde92
SHA1

3abbafbd84af7a824bd34ac2ba67e2e791b40704
SHA256

050d2dd1b332f3f22ab3b00a3f144aad964b963bec942c20926b4892a8428e60
SHA512

176d235766401a4f7a3639d5b70d118e80b46445f5ef43322685965386d415ba3d6bbd1b6263aaa4b80a264dfc470fe37b76c3400fe3c2936b6cf8b636205c5f
SSDEEP

12288:USn0JQtsP8qtoSZoRB7SFkTg9UODo7NKpvdauOH+9FKD9iH:U46Eqru9Tg91hfe

Score

1^/10

Suspicious use of UnmapMainImage 3 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 2508	832	47320f9582fbd915b4714a843a0cde92.exe	28
PID 832 wrote to memory of 2508	832	47320f9582fbd915b4714a843a0cde92.exe	28
PID 832 wrote to memory of 2508	832	47320f9582fbd915b4714a843a0cde92.exe	28
PID 832 wrote to memory of 2508	832	47320f9582fbd915b4714a843a0cde92.exe	28
PID 832 wrote to memory of 1720	832	47320f9582fbd915b4714a843a0cde92.exe	29
PID 832 wrote to memory of 1720	832	47320f9582fbd915b4714a843a0cde92.exe	29
PID 832 wrote to memory of 1720	832	47320f9582fbd915b4714a843a0cde92.exe	29
PID 832 wrote to memory of 1720	832	47320f9582fbd915b4714a843a0cde92.exe	29

C:\Users\Admin\AppData\Local\Temp\47320f9582fbd915b4714a843a0cde92.exe
"C:\Users\Admin\AppData\Local\Temp\47320f9582fbd915b4714a843a0cde92.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:832
- C:\Users\Admin\AppData\Local\Temp\47320f9582fbd915b4714a843a0cde92.exe
  start
  2⤵
  - Suspicious use of UnmapMainImage
  PID:2508
- C:\Users\Admin\AppData\Local\Temp\47320f9582fbd915b4714a843a0cde92.exe
  watch
  2⤵
  - Suspicious use of UnmapMainImage
  PID:1720

memory/832-0-0x000000007EF90000-0x000000007EFAF000-memory.dmp

Filesize
124KB

Download
memory/832-1-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/832-2-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/832-7-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1720-4-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/1720-6-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2508-3-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2508-5-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download