a6e4a9ea11c34b1ec6fa2c14b8c68d5a22434807b1267fe0018f968821062be9

Analysis

max time kernel
91s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 13:22

Target

a6e4a9ea11c34b1ec6fa2c14b8c68d5a22434807b1267fe0018f968821062be9.exe
Size

588KB
MD5

2188951338898761c0cc0046652fb4b0
SHA1

fedfb369f858df1f40b292910745825df93b345d
SHA256

a6e4a9ea11c34b1ec6fa2c14b8c68d5a22434807b1267fe0018f968821062be9
SHA512

c03a37318db756fa9650981638c84b3303e6480041308a8fa04285e257f4a5c33062cdae50aa2ab0d56681560abfcfbf75769f55a3a202567f561cce5c8a0739
SSDEEP

12288:eEmSQK653EH+2+MZY1FjuKeNRFIXe3jtedGuMC9MoS5u8BwHm/sJtZikGcEiT/3Z:TmzK653EH4MIXe3jt1uTe5YWvg

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 3972	1652	a6e4a9ea11c34b1ec6fa2c14b8c68d5a22434807b1267fe0018f968821062be9.exe	82
PID 1652 wrote to memory of 3972	1652	a6e4a9ea11c34b1ec6fa2c14b8c68d5a22434807b1267fe0018f968821062be9.exe	82
PID 1652 wrote to memory of 3972	1652	a6e4a9ea11c34b1ec6fa2c14b8c68d5a22434807b1267fe0018f968821062be9.exe	82

C:\Users\Admin\AppData\Local\Temp\a6e4a9ea11c34b1ec6fa2c14b8c68d5a22434807b1267fe0018f968821062be9.exe
"C:\Users\Admin\AppData\Local\Temp\a6e4a9ea11c34b1ec6fa2c14b8c68d5a22434807b1267fe0018f968821062be9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:3972