b66c905ec9d86789d138da78ce5759af24e14da76f74dce3871e8138e337bb8a

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 02:38

Target

b66c905ec9d86789d138da78ce5759af24e14da76f74dce3871e8138e337bb8aN.exe
Size

2.3MB
MD5

3fd58e9d63be458405779eef879cec50
SHA1

05438a62dfbe61c8d114650b34ce3ecf58c7ac18
SHA256

b66c905ec9d86789d138da78ce5759af24e14da76f74dce3871e8138e337bb8a
SHA512

fb202597beec6fde6be9108d97c3133d627ea939476b1c4317e447e9b09a51ddbcdf7acae7e425247002572405b7da1f928b91d7c3565c05587fa5e38484d2fb
SSDEEP

24576:qKqvE34cE2ZsbwFD7temjHDcx/p0Uo1oP5JDk1o41SGIwD+Ec0xMkN8JsU3Ao7vR:kvE3xyMtemTDcxBb/eoxwIvdlZf

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2148	2080	b66c905ec9d86789d138da78ce5759af24e14da76f74dce3871e8138e337bb8aN.exe	29
PID 2080 wrote to memory of 2148	2080	b66c905ec9d86789d138da78ce5759af24e14da76f74dce3871e8138e337bb8aN.exe	29
PID 2080 wrote to memory of 2148	2080	b66c905ec9d86789d138da78ce5759af24e14da76f74dce3871e8138e337bb8aN.exe	29

C:\Users\Admin\AppData\Local\Temp\b66c905ec9d86789d138da78ce5759af24e14da76f74dce3871e8138e337bb8aN.exe
"C:\Users\Admin\AppData\Local\Temp\b66c905ec9d86789d138da78ce5759af24e14da76f74dce3871e8138e337bb8aN.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:2148

memory/2080-0-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download