aa5a30260cddeba418b4864b57f5021b174730092592a9ec4e7bb7b0a2c00b40

Analysis

max time kernel
0s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 05:15

Target

4fad632edc2d19d3a340bdc722c6df26.exe
Size

2.1MB
MD5

4fad632edc2d19d3a340bdc722c6df26
SHA1

99964fead7f90c45b1634c594d1c77a82f62ea75
SHA256

aa5a30260cddeba418b4864b57f5021b174730092592a9ec4e7bb7b0a2c00b40
SHA512

a152149b867cb0c7ac1221988d1375c8a770d3142b2ab5dc6481aca28078c49a164d416e6433125ca8712464f1a2a100bf44b3c684eda78b7bd3b768af87c274
SSDEEP

49152:bfXUpuYQuqi+HjFJNg8xfwoy5yxWXfAB92Jbv4g2MH6U8rTF:bPgQuSHLNVqFXfnv45M9u

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2944	2360	4fad632edc2d19d3a340bdc722c6df26.exe	26
PID 2360 wrote to memory of 2944	2360	4fad632edc2d19d3a340bdc722c6df26.exe	26
PID 2360 wrote to memory of 2944	2360	4fad632edc2d19d3a340bdc722c6df26.exe	26
PID 2360 wrote to memory of 2944	2360	4fad632edc2d19d3a340bdc722c6df26.exe	26

C:\Users\Admin\AppData\Local\Temp\4fad632edc2d19d3a340bdc722c6df26.exe
"C:\Users\Admin\AppData\Local\Temp\4fad632edc2d19d3a340bdc722c6df26.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\arp.exe
  "C:\Windows\System32\arp.exe" -a
  2⤵
  PID:2944

memory/2360-1-0x0000000074B70000-0x000000007525E000-memory.dmp

Filesize
6.9MB

Download
memory/2360-0-0x0000000000D70000-0x0000000000F92000-memory.dmp

Filesize
2.1MB

Download
memory/2360-3-0x0000000004F00000-0x0000000004F40000-memory.dmp

Filesize
256KB

Download
memory/2360-2-0x0000000007190000-0x00000000073A4000-memory.dmp

Filesize
2.1MB

Download
memory/2360-4-0x0000000074B70000-0x000000007525E000-memory.dmp

Filesize
6.9MB

Download