d20d4e2e76d4474319fbcc313be5eb49b50447465aff5cef68c12061cc571014

Analysis

max time kernel
181s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-10-2022 18:12

Target

d20d4e2e76d4474319fbcc313be5eb49b50447465aff5cef68c12061cc571014.exe
Size

159KB
MD5

5f86d2947a2931a93188fc44d0e32dd0
SHA1

1d4c6dbd099e98e6a2b7c6bb85dbceef653544b9
SHA256

d20d4e2e76d4474319fbcc313be5eb49b50447465aff5cef68c12061cc571014
SHA512

1193d050860f6d5c490e9ca031227ec55e38d8b560492997892eb07bd8bc151d3d650d520d6e60749ca325e0480a8dbaa6e164fc9ea7b919890d869f5604ecf7
SSDEEP

3072:2E70IPDrjY1FKX3zFkv7MYss4+LxyYkpUgKQx:2E70IPDwjqzFIBf4/Y0UgK

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 3192	2372	d20d4e2e76d4474319fbcc313be5eb49b50447465aff5cef68c12061cc571014.exe	82
PID 2372 wrote to memory of 3192	2372	d20d4e2e76d4474319fbcc313be5eb49b50447465aff5cef68c12061cc571014.exe	82
PID 2372 wrote to memory of 3192	2372	d20d4e2e76d4474319fbcc313be5eb49b50447465aff5cef68c12061cc571014.exe	82

C:\Users\Admin\AppData\Local\Temp\d20d4e2e76d4474319fbcc313be5eb49b50447465aff5cef68c12061cc571014.exe
"C:\Users\Admin\AppData\Local\Temp\d20d4e2e76d4474319fbcc313be5eb49b50447465aff5cef68c12061cc571014.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Users\Admin\AppData\Local\Temp\d20d4e2e76d4474319fbcc313be5eb49b50447465aff5cef68c12061cc571014.exe
  "C:\Users\Admin\AppData\Local\Temp\d20d4e2e76d4474319fbcc313be5eb49b50447465aff5cef68c12061cc571014.exe" 3228790259447105115
  2⤵
  PID:3192

memory/3192-133-0x0000000000000000-mapping.dmp

Download
memory/3192-134-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download