5a132da170fc4969a269f8e9f9598022505fbc0adeba8a2bb9c9d57e607ed4a6

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 13:26

Target

5a132da170fc4969a269f8e9f9598022505fbc0adeba8a2bb9c9d57e607ed4a6.exe
Size

46KB
MD5

65c0e08c0fee35ef06dc1468f1f2a120
SHA1

e215b39b2162916cf42d8e7819f32373a445091e
SHA256

5a132da170fc4969a269f8e9f9598022505fbc0adeba8a2bb9c9d57e607ed4a6
SHA512

576c589d53e37e55f9d1adc31bde9536920c8fdb0f228ad1d5ec24a6e05f2a113f117dfdf7be1b4b1684be19ef9bd998b555531397c665c3c549a88e95d47d75
SSDEEP

768:uuw8Cxfha5IHKrJ3Rm/I4ZNdR/SKpw8tJ3yVH4Na0qeAmcijib:PClKd3RYI4DDtUVHe5ci4

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 3300	2040	5a132da170fc4969a269f8e9f9598022505fbc0adeba8a2bb9c9d57e607ed4a6.exe	84
PID 2040 wrote to memory of 3300	2040	5a132da170fc4969a269f8e9f9598022505fbc0adeba8a2bb9c9d57e607ed4a6.exe	84
PID 2040 wrote to memory of 3300	2040	5a132da170fc4969a269f8e9f9598022505fbc0adeba8a2bb9c9d57e607ed4a6.exe	84

C:\Users\Admin\AppData\Local\Temp\5a132da170fc4969a269f8e9f9598022505fbc0adeba8a2bb9c9d57e607ed4a6.exe
"C:\Users\Admin\AppData\Local\Temp\5a132da170fc4969a269f8e9f9598022505fbc0adeba8a2bb9c9d57e607ed4a6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:3300

memory/2040-132-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2040-134-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download