cabf59797b8c22d408bfe3dc477f1b94326da6fae5b8799d432168b53bbb416f

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24-02-2024 06:18

Target

a127ff060746ae559c5325aa8ac34625.exe
Size

192KB
MD5

a127ff060746ae559c5325aa8ac34625
SHA1

57d0264575130b63161c6db6b0cd9ad331885fbf
SHA256

cabf59797b8c22d408bfe3dc477f1b94326da6fae5b8799d432168b53bbb416f
SHA512

8c1ccddf9d1c6ce59cbfec51dfdb2e7b4d8f4781b80a02275ed31d63463394d03fdfbacbc466ddb8f15c4b1fe250820f23a19ccb408062ce002efcdf1552990d
SSDEEP

3072:af4x4PHwcihag2Hfwn0I8OBoKiKwEbNnYBfzJ1/WsYtxt8Wj84mcW8+c:pOPHwcihag2/WZ8qbjXNYBrfO5xt8WwD

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1220	1724	a127ff060746ae559c5325aa8ac34625.exe	15
PID 1724 wrote to memory of 1220	1724	a127ff060746ae559c5325aa8ac34625.exe	15

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1220
- C:\Users\Admin\AppData\Local\Temp\a127ff060746ae559c5325aa8ac34625.exe
  "C:\Users\Admin\AppData\Local\Temp\a127ff060746ae559c5325aa8ac34625.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1724

memory/1220-2-0x0000000002E20000-0x0000000002E29000-memory.dmp

Filesize
36KB

Download
memory/1220-4-0x0000000002E20000-0x0000000002E29000-memory.dmp

Filesize
36KB

Download
memory/1724-0-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/1724-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1724-6-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download