d8b90d10b859ceb0408bfc6b21e1b2449a2fe4c235a0f552968cdf2c5a868351

Analysis

max time kernel
185s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 22:11

Target
d8b90d10b859ceb0408bfc6b21e1b2449a2fe4c235a0f552968cdf2c5a868351.exe
Size 27KB
Sample221002-13znraecer
SHA256 d8b90d10b859ceb0408bfc6b21e1b2449a2fe4c235a0f552968cdf2c5a868351
MD5 051d55a475ecd2d943ba7900229d4030
SHA1 b8c5e9e7bb314e82d240fdd95ebbbb0acf488c2d
SHA512 a9ebfae01cf0e7a8f6b3d51835df52967f0e9be1c8627069fc3b3c2669f1854d19bed72dcdd257dd2ea7aa9b5be4e72aa504d340000099d3dd396d9c1ae94060
SSDEEP 384:zx8QArUxe15Sgd9sgipYFsVDqXyVIkfkT1RvjFVa5RIQybPp18HZ:zx8TAe1r96Vbfk1Va5RIQI3K
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 4212	5032	d8b90d10b859ceb0408bfc6b21e1b2449a2fe4c235a0f552968cdf2c5a868351.exe	81
PID 5032 wrote to memory of 4212	5032	d8b90d10b859ceb0408bfc6b21e1b2449a2fe4c235a0f552968cdf2c5a868351.exe	81
PID 5032 wrote to memory of 4212	5032	d8b90d10b859ceb0408bfc6b21e1b2449a2fe4c235a0f552968cdf2c5a868351.exe	81

C:\Users\Admin\AppData\Local\Temp\d8b90d10b859ceb0408bfc6b21e1b2449a2fe4c235a0f552968cdf2c5a868351.exe
"C:\Users\Admin\AppData\Local\Temp\d8b90d10b859ceb0408bfc6b21e1b2449a2fe4c235a0f552968cdf2c5a868351.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:4212

memory/5032-132-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/5032-134-0x0000000000400000-0x000000000040A000-memory.dmp

Download