c22a98c5ef21699cf1b2e45b25cd04bbb44121078f2604820606e9455673735a

Analysis

max time kernel
89s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2024 05:40

Target

7f074da2194055199bec9996fcc382bc.exe
Size

498KB
MD5

7f074da2194055199bec9996fcc382bc
SHA1

a463f7184593956742f6c61d55b0f4db8df10b84
SHA256

c22a98c5ef21699cf1b2e45b25cd04bbb44121078f2604820606e9455673735a
SHA512

f1641d016b7afa10104f1b244b00a9b20c8589bb4186a97b471f3f62dcc8eaa48f438dc6dbda85457c8a1c6552b1e966a5ebbfc1d7b84722af54704196749a2c
SSDEEP

12288:S2wyuuPGC/7X1yAP1egsPi183uT4BsPBTTjo1vorHF/:Zwq/7V1eVa1837Bs1TOorHF/

Score

1^/10

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2132	7f074da2194055199bec9996fcc382bc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 1616	2132	7f074da2194055199bec9996fcc382bc.exe	57
PID 2132 wrote to memory of 1616	2132	7f074da2194055199bec9996fcc382bc.exe	57
PID 2132 wrote to memory of 1616	2132	7f074da2194055199bec9996fcc382bc.exe	57

C:\Users\Admin\AppData\Local\Temp\7f074da2194055199bec9996fcc382bc.exe
"C:\Users\Admin\AppData\Local\Temp\7f074da2194055199bec9996fcc382bc.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Users\Admin\AppData\Local\Temp\7f074da2194055199bec9996fcc382bc.exe
  "C:\Users\Admin\AppData\Local\Temp\7f074da2194055199bec9996fcc382bc.exe"
  2⤵
  PID:1616

memory/2132-1-0x0000000000600000-0x0000000000700000-memory.dmp

Filesize
1024KB

Download
memory/2132-2-0x00000000007F0000-0x00000000007F2000-memory.dmp

Filesize
8KB

Download