057a769083897d7af662204e1359ed3e8bf00ba01e4cd56fd6a33ad2dcdfff18

Analysis

max time kernel
146s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 12:01

Target

057a769083897d7af662204e1359ed3e8bf00ba01e4cd56fd6a33ad2dcdfff18.exe
Size

481KB
MD5

51abdd89c889d9d6fbb49b6e8a408db0
SHA1

eaaa48582090ca3e05b4c8694ac8665553531c22
SHA256

057a769083897d7af662204e1359ed3e8bf00ba01e4cd56fd6a33ad2dcdfff18
SHA512

270d54ae85c338f484a89fc1eaf53f0faa51bca5203cf80e20a3787f737368ce719da6790eb344269cdfb38da403763de60c1d92d6fb7afb91be83d9228eef4c
SSDEEP

12288:E7WWlglkORtGIShdEptF5V8a5ulA2yTyICRwC:ENC6WtGISfpQulvyTMqC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 616 wrote to memory of 540	616	057a769083897d7af662204e1359ed3e8bf00ba01e4cd56fd6a33ad2dcdfff18.exe	82
PID 616 wrote to memory of 540	616	057a769083897d7af662204e1359ed3e8bf00ba01e4cd56fd6a33ad2dcdfff18.exe	82
PID 616 wrote to memory of 540	616	057a769083897d7af662204e1359ed3e8bf00ba01e4cd56fd6a33ad2dcdfff18.exe	82

C:\Users\Admin\AppData\Local\Temp\057a769083897d7af662204e1359ed3e8bf00ba01e4cd56fd6a33ad2dcdfff18.exe
"C:\Users\Admin\AppData\Local\Temp\057a769083897d7af662204e1359ed3e8bf00ba01e4cd56fd6a33ad2dcdfff18.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:616
- C:\Users\Admin\AppData\Local\Temp\057a769083897d7af662204e1359ed3e8bf00ba01e4cd56fd6a33ad2dcdfff18.exe
  tear
  2⤵
  PID:540

memory/540-136-0x0000000005000000-0x0000000005056000-memory.dmp

Filesize
344KB

Download
memory/540-137-0x0000000005000000-0x0000000005056000-memory.dmp

Filesize
344KB

Download
memory/616-132-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/616-134-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/616-135-0x0000000005000000-0x0000000005056000-memory.dmp

Filesize
344KB

Download