a5e1cd59be9eea588b77b6361e45fa4a4b292c10885dfb31143659263f0b04c5

Analysis

max time kernel
80s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 12:30

Target

a5e1cd59be9eea588b77b6361e45fa4a4b292c10885dfb31143659263f0b04c5.exe
Size

15KB
MD5

347c7dec82ea6a1013a53f6511e60e16
SHA1

aa0159f8cd0eff34843dccaca4479e4958891e26
SHA256

a5e1cd59be9eea588b77b6361e45fa4a4b292c10885dfb31143659263f0b04c5
SHA512

ccc5433e45e91415a3767bcd95840a104d6249d4e9473704fdab487d9df76cc7e003fc1e87081326fafb89cfc618f3767d38fd2a4d308f8077c5d1876a860891
SSDEEP

384:IwFIaBq7b2No1b5o7IctZFOCNxcTCND1QMw+cL0i:IwBB2x3S7xcOw+n

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 1192	4812	a5e1cd59be9eea588b77b6361e45fa4a4b292c10885dfb31143659263f0b04c5.exe	82
PID 4812 wrote to memory of 1192	4812	a5e1cd59be9eea588b77b6361e45fa4a4b292c10885dfb31143659263f0b04c5.exe	82
PID 4812 wrote to memory of 1192	4812	a5e1cd59be9eea588b77b6361e45fa4a4b292c10885dfb31143659263f0b04c5.exe	82

C:\Users\Admin\AppData\Local\Temp\a5e1cd59be9eea588b77b6361e45fa4a4b292c10885dfb31143659263f0b04c5.exe
"C:\Users\Admin\AppData\Local\Temp\a5e1cd59be9eea588b77b6361e45fa4a4b292c10885dfb31143659263f0b04c5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a5e1cd59be9eea588b77b6361e45fa4a4b292c10885dfb31143659263f0b04c5.bat"
  2⤵
  PID:1192

C:\Users\Admin\AppData\Local\Temp\a5e1cd59be9eea588b77b6361e45fa4a4b292c10885dfb31143659263f0b04c5.bat

Filesize
361B

MD5
752909e1b0a16280de189bf6760741ae

SHA1
d3635abdcef0972e72a7f88223c949640121009b

SHA256
748337efd9dc587f83cbaa8c0b643b209ab20ffa5c01857a611334c55c97bbf0

SHA512
c5cd0eeec3eba080956c63f41b7a8414797eb88cbc38f5de21668cc4210be7d45eef07324fac78b2c2c99ebd2f6a0139216c41482e3cb53f6395f5780b332e55

Download Submit
memory/4812-133-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4812-134-0x0000000000030000-0x0000000000036000-memory.dmp

Filesize
24KB

Download