ee869063a0b16ab469bb7703f7bb03f05fafc7a429de06d22efba7e205fefddb

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 02:34

Target

ee869063a0b16ab469bb7703f7bb03f05fafc7a429de06d22efba7e205fefddb.exe
Size

40KB
MD5

574f73ef868019b06a9be37f04d9c055
SHA1

bd1e00bf9c247bc4151fa67b9b02db6d4d5d3117
SHA256

ee869063a0b16ab469bb7703f7bb03f05fafc7a429de06d22efba7e205fefddb
SHA512

e686e6060477a3900a7015e0dd410d586e52be7cca5c9c5218e9130e4dcdf3fc2ac5f433de069b92c0fb05f2941f2d5e3293239d71d945f5c1f43cea94619d39
SSDEEP

768:/mBmjArVFc2XPnmKqlqdiaCfVYvYZUAYclb:+BmF2fnmKgZUW

Score

1^/10

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 1712	2280	ee869063a0b16ab469bb7703f7bb03f05fafc7a429de06d22efba7e205fefddb.exe	28
PID 2280 wrote to memory of 1712	2280	ee869063a0b16ab469bb7703f7bb03f05fafc7a429de06d22efba7e205fefddb.exe	28
PID 2280 wrote to memory of 1712	2280	ee869063a0b16ab469bb7703f7bb03f05fafc7a429de06d22efba7e205fefddb.exe	28
PID 2280 wrote to memory of 1712	2280	ee869063a0b16ab469bb7703f7bb03f05fafc7a429de06d22efba7e205fefddb.exe	28
PID 2280 wrote to memory of 2912	2280	ee869063a0b16ab469bb7703f7bb03f05fafc7a429de06d22efba7e205fefddb.exe	29
PID 2280 wrote to memory of 2912	2280	ee869063a0b16ab469bb7703f7bb03f05fafc7a429de06d22efba7e205fefddb.exe	29
PID 2280 wrote to memory of 2912	2280	ee869063a0b16ab469bb7703f7bb03f05fafc7a429de06d22efba7e205fefddb.exe	29
PID 2280 wrote to memory of 2912	2280	ee869063a0b16ab469bb7703f7bb03f05fafc7a429de06d22efba7e205fefddb.exe	29

C:\Users\Admin\AppData\Local\Temp\ee869063a0b16ab469bb7703f7bb03f05fafc7a429de06d22efba7e205fefddb.exe
"C:\Users\Admin\AppData\Local\Temp\ee869063a0b16ab469bb7703f7bb03f05fafc7a429de06d22efba7e205fefddb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\SysWOW64\cmd.exe
  cmd /c md c:\TEMP
  2⤵
  PID:1712
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del c:\temp\wu.cmd
  2⤵
  PID:2912

memory/2280-0-0x0000000074A8E000-0x0000000074A8F000-memory.dmp

Filesize
4KB

Download
memory/2280-1-0x0000000000B50000-0x0000000000B62000-memory.dmp

Filesize
72KB

Download
memory/2280-2-0x0000000074A80000-0x000000007516E000-memory.dmp

Filesize
6.9MB

Download
memory/2280-3-0x0000000074A8E000-0x0000000074A8F000-memory.dmp

Filesize
4KB

Download
memory/2280-4-0x0000000074A80000-0x000000007516E000-memory.dmp

Filesize
6.9MB

Download