00c97bd0e7cacc5d91a6d0bb11fe4c75c66717cb7bcebcad5a817e7dfed21f1f

Analysis

max time kernel
142s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2022 02:32

Target

00c97bd0e7cacc5d91a6d0bb11fe4c75c66717cb7bcebcad5a817e7dfed21f1f.exe
Size

522KB
MD5

7924ec088d5acb569e6bc5b4e69f976c
SHA1

5f7aa1a150ea364779f3a8a869c0c839e37e6a81
SHA256

00c97bd0e7cacc5d91a6d0bb11fe4c75c66717cb7bcebcad5a817e7dfed21f1f
SHA512

cdb7ea89857300cc8830b0c444f4d031cc3c2da6ad77125380cd680dfa3bd775a5357ff251dcc67e5058cc9a2818cb97c8c6fa750564dd2478631d0364110ba7
SSDEEP

12288:+lzQ/K8Yix/XwTFblkP2eGWfy18xQqpx8O5q:+H3CQbmP1atqpx8

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 1692	4772	00c97bd0e7cacc5d91a6d0bb11fe4c75c66717cb7bcebcad5a817e7dfed21f1f.exe	81
PID 4772 wrote to memory of 1692	4772	00c97bd0e7cacc5d91a6d0bb11fe4c75c66717cb7bcebcad5a817e7dfed21f1f.exe	81
PID 4772 wrote to memory of 1692	4772	00c97bd0e7cacc5d91a6d0bb11fe4c75c66717cb7bcebcad5a817e7dfed21f1f.exe	81
PID 4772 wrote to memory of 4760	4772	00c97bd0e7cacc5d91a6d0bb11fe4c75c66717cb7bcebcad5a817e7dfed21f1f.exe	82
PID 4772 wrote to memory of 4760	4772	00c97bd0e7cacc5d91a6d0bb11fe4c75c66717cb7bcebcad5a817e7dfed21f1f.exe	82
PID 4772 wrote to memory of 4760	4772	00c97bd0e7cacc5d91a6d0bb11fe4c75c66717cb7bcebcad5a817e7dfed21f1f.exe	82

C:\Users\Admin\AppData\Local\Temp\00c97bd0e7cacc5d91a6d0bb11fe4c75c66717cb7bcebcad5a817e7dfed21f1f.exe
"C:\Users\Admin\AppData\Local\Temp\00c97bd0e7cacc5d91a6d0bb11fe4c75c66717cb7bcebcad5a817e7dfed21f1f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Users\Admin\AppData\Local\Temp\00c97bd0e7cacc5d91a6d0bb11fe4c75c66717cb7bcebcad5a817e7dfed21f1f.exe
  start
  2⤵
  PID:1692
- C:\Users\Admin\AppData\Local\Temp\00c97bd0e7cacc5d91a6d0bb11fe4c75c66717cb7bcebcad5a817e7dfed21f1f.exe
  watch
  2⤵
  PID:4760

memory/1692-134-0x0000000000000000-mapping.dmp

Download
memory/1692-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1692-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4760-133-0x0000000000000000-mapping.dmp

Download
memory/4760-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4760-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4760-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4772-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4772-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download