db68a3608c414595c4577f6822dde58a97ccfb875fd5378c79d247143403e89b

Analysis

max time kernel
21s
max time network
26s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14-08-2024 09:28

Target

11dfa8509a25f759aaf24a28c6242400N.exe
Size

7KB
MD5

11dfa8509a25f759aaf24a28c6242400
SHA1

3bb0bceeeb6608be99b04339a89af0e03a42085d
SHA256

db68a3608c414595c4577f6822dde58a97ccfb875fd5378c79d247143403e89b
SHA512

31d1b05b8835e8b645fb3e5c3d8eeb926cc9bd81d1a7f16128d64524853e90d26a5de0f46a164ce6fd6c6417989694182c3cdde877fcd1fffdd1ea2defbc10fd
SSDEEP

24:eFGStrJ9u0/6P8GnZdEBQAV8aKq9K9qyoeNDJSqUmZEWdXCIGDpmB:is0xeEBQpE9TSDoqUjWZCSB

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 2592	2712	11dfa8509a25f759aaf24a28c6242400N.exe	30
PID 2712 wrote to memory of 2592	2712	11dfa8509a25f759aaf24a28c6242400N.exe	30
PID 2712 wrote to memory of 2592	2712	11dfa8509a25f759aaf24a28c6242400N.exe	30

C:\Users\Admin\AppData\Local\Temp\11dfa8509a25f759aaf24a28c6242400N.exe
"C:\Users\Admin\AppData\Local\Temp\11dfa8509a25f759aaf24a28c6242400N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:2592

memory/2712-0-0x0000000140000000-0x0000000140004248-memory.dmp

Filesize
16KB

Download