d2b22ba7ddae5852456c38e5c19e3514503f36ea1a10f2ba72fa581da7b4f732

Analysis

max time kernel
170s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20-10-2022 19:28

Target

d2b22ba7ddae5852456c38e5c19e3514503f36ea1a10f2ba72fa581da7b4f732.exe
Size

56KB
MD5

96837a9760be5f8d794b6f7ffdf74e30
SHA1

ae14736ab2502bc9e6ccb6ef889855871592822a
SHA256

d2b22ba7ddae5852456c38e5c19e3514503f36ea1a10f2ba72fa581da7b4f732
SHA512

ee8fef8bf650366c5b39b2e89bfee0cc8d3b2fddb43ca78edc5b4fcc2f589411d1a0ad0432d11c57722f5e4749d3b5221a0032524f58e1980d92a43a1fbe7fe1
SSDEEP

1536:5UXYdxsHSBCqT87Dvhi5RzZ6f/YvDf928avVTskg:5UXypCDlEZpvDY88W

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 752	4656	d2b22ba7ddae5852456c38e5c19e3514503f36ea1a10f2ba72fa581da7b4f732.exe	80
PID 4656 wrote to memory of 752	4656	d2b22ba7ddae5852456c38e5c19e3514503f36ea1a10f2ba72fa581da7b4f732.exe	80
PID 4656 wrote to memory of 752	4656	d2b22ba7ddae5852456c38e5c19e3514503f36ea1a10f2ba72fa581da7b4f732.exe	80

C:\Users\Admin\AppData\Local\Temp\d2b22ba7ddae5852456c38e5c19e3514503f36ea1a10f2ba72fa581da7b4f732.exe
"C:\Users\Admin\AppData\Local\Temp\d2b22ba7ddae5852456c38e5c19e3514503f36ea1a10f2ba72fa581da7b4f732.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Users\Admin\AppData\Local\Temp\d2b22ba7ddae5852456c38e5c19e3514503f36ea1a10f2ba72fa581da7b4f732.exe
  C:\Users\Admin\AppData\Local\Temp\d2b22ba7ddae58524" 48
  2⤵
  PID:752

memory/752-133-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download