dcf5ac25b61cc920fff9fe26cae964e2a52904a1137db23c50b91fbdca06964e

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 21:24

Target

d7258d6ed2b71a87b1da47544c4c5b4a.exe
Size

24KB
MD5

d7258d6ed2b71a87b1da47544c4c5b4a
SHA1

f0299aeec96ef2728c12b4385636d1b927e50d7b
SHA256

dcf5ac25b61cc920fff9fe26cae964e2a52904a1137db23c50b91fbdca06964e
SHA512

56f22504a97e7d7307bad1306f6ec10126d5ef2b4ca1a857dd8eb006c623c71607fee615abbf7df04e513671864f7f64a4e48d185193716700f0df1427285463
SSDEEP

384:L4FB9+eBYtiEYD5K5OrJBCdCd3hjx5tB0qishj7Ma2XuPSZa9uy3X5bSr5rC4oS9:wDnbD5lJBCdSZDtlispf2vTy3pC5rsSl

Score

1^/10

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 2188	2948	d7258d6ed2b71a87b1da47544c4c5b4a.exe	28
PID 2948 wrote to memory of 2188	2948	d7258d6ed2b71a87b1da47544c4c5b4a.exe	28
PID 2948 wrote to memory of 2188	2948	d7258d6ed2b71a87b1da47544c4c5b4a.exe	28
PID 2948 wrote to memory of 2188	2948	d7258d6ed2b71a87b1da47544c4c5b4a.exe	28
PID 2948 wrote to memory of 3068	2948	d7258d6ed2b71a87b1da47544c4c5b4a.exe	29
PID 2948 wrote to memory of 3068	2948	d7258d6ed2b71a87b1da47544c4c5b4a.exe	29
PID 2948 wrote to memory of 3068	2948	d7258d6ed2b71a87b1da47544c4c5b4a.exe	29
PID 2948 wrote to memory of 3068	2948	d7258d6ed2b71a87b1da47544c4c5b4a.exe	29
PID 3068 wrote to memory of 3016	3068	cmd.exe	33
PID 3068 wrote to memory of 3016	3068	cmd.exe	33
PID 3068 wrote to memory of 3016	3068	cmd.exe	33
PID 3068 wrote to memory of 3016	3068	cmd.exe	33
PID 2188 wrote to memory of 2656	2188	cmd.exe	32
PID 2188 wrote to memory of 2656	2188	cmd.exe	32
PID 2188 wrote to memory of 2656	2188	cmd.exe	32
PID 2188 wrote to memory of 2656	2188	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\d7258d6ed2b71a87b1da47544c4c5b4a.exe
"C:\Users\Admin\AppData\Local\Temp\d7258d6ed2b71a87b1da47544c4c5b4a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\SysWOW64\cmd.exe
  cmd /c reg ADD /v /t /d /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Windows\SysWOW64\reg.exe
    reg ADD /v /t /d /f
    3⤵
    PID:2656
- C:\Windows\SysWOW64\cmd.exe
  cmd /c reg ADD /v /t /d /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\SysWOW64\reg.exe
    reg ADD /v /t /d /f
    3⤵
    PID:3016

memory/2948-4-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2948-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download