ab0607bc56f4f2ecbf020a610aefb52d4899445a4a204ade06a5c8e34c13bd61

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 13:41

Target

ab0607bc56f4f2ecbf020a610aefb52d4899445a4a204ade06a5c8e34c13bd61.exe
Size

528KB
MD5

120ec274a9dd73a021302962ec466d7a
SHA1

c414da15aa9a2b0953bdf8c399b93a5b7798f06e
SHA256

ab0607bc56f4f2ecbf020a610aefb52d4899445a4a204ade06a5c8e34c13bd61
SHA512

b868887b1e02755ac5606f0a004dfbe351a1b3b3c42c5e350e4279ab36421aa948ba9b62d819274c28b338f36478bb70c600b507a9b52b39785caec7deafaea0
SSDEEP

12288:Ckv/s8r200pYbs+rxwbf7Nz0wh2DhqpnAToZgQmjg:CuDr70pYbflaDNz0wS8gQmU

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 3972	1360	ab0607bc56f4f2ecbf020a610aefb52d4899445a4a204ade06a5c8e34c13bd61.exe	80
PID 1360 wrote to memory of 3972	1360	ab0607bc56f4f2ecbf020a610aefb52d4899445a4a204ade06a5c8e34c13bd61.exe	80
PID 1360 wrote to memory of 3972	1360	ab0607bc56f4f2ecbf020a610aefb52d4899445a4a204ade06a5c8e34c13bd61.exe	80

C:\Users\Admin\AppData\Local\Temp\ab0607bc56f4f2ecbf020a610aefb52d4899445a4a204ade06a5c8e34c13bd61.exe
"C:\Users\Admin\AppData\Local\Temp\ab0607bc56f4f2ecbf020a610aefb52d4899445a4a204ade06a5c8e34c13bd61.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Users\Admin\AppData\Local\Temp\ab0607bc56f4f2ecbf020a610aefb52d4899445a4a204ade06a5c8e34c13bd61.exe
  tear
  2⤵
  PID:3972

memory/1360-133-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/3972-134-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/3972-135-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download