6d70fd1b6a413f4a668f632db6abb7e7ebd44f6dbace1e7f1b29cf70ea48ef54

Analysis

max time kernel
142s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 23:26

Target

6d70fd1b6a413f4a668f632db6abb7e7ebd44f6dbace1e7f1b29cf70ea48ef54.exe
Size

310KB
MD5

322cd32e6010f5335ce96df06e76ac50
SHA1

cd0051e849e02459c3bd1565ec1b5cc732348a94
SHA256

6d70fd1b6a413f4a668f632db6abb7e7ebd44f6dbace1e7f1b29cf70ea48ef54
SHA512

52a44b9fc8462de64f341ff9c7908c04baa2071a77b8dea2158b0289ab0a5256fd9aeb4ebcd871adc850bac62b84a2df9b6ec532f38af71a5b9b7d3ed9035397
SSDEEP

6144:C1b11aeDZsNKIOSzzmuTGLdrU3hC8+s/lUq/1d3lWXlvoWm1mrsw9DZlXe:CVTkFmV6h7Fd/jlWXlgWD99DZl

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 860 wrote to memory of 1472	860	6d70fd1b6a413f4a668f632db6abb7e7ebd44f6dbace1e7f1b29cf70ea48ef54.exe	83
PID 860 wrote to memory of 1472	860	6d70fd1b6a413f4a668f632db6abb7e7ebd44f6dbace1e7f1b29cf70ea48ef54.exe	83
PID 860 wrote to memory of 1472	860	6d70fd1b6a413f4a668f632db6abb7e7ebd44f6dbace1e7f1b29cf70ea48ef54.exe	83

C:\Users\Admin\AppData\Local\Temp\6d70fd1b6a413f4a668f632db6abb7e7ebd44f6dbace1e7f1b29cf70ea48ef54.exe
"C:\Users\Admin\AppData\Local\Temp\6d70fd1b6a413f4a668f632db6abb7e7ebd44f6dbace1e7f1b29cf70ea48ef54.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:860
- C:\Users\Admin\AppData\Local\Temp\6d70fd1b6a413f4a668f632db6abb7e7ebd44f6dbace1e7f1b29cf70ea48ef54.exe
  tear
  2⤵
  PID:1472

memory/860-134-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1472-135-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1472-136-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download