dcf57efbef232c43a6f55fb4a45fdc92255e86cac89703fea9eae12f321ca2db

Analysis

max time kernel
187s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:10

Target

dcf57efbef232c43a6f55fb4a45fdc92255e86cac89703fea9eae12f321ca2db.exe
Size

520KB
MD5

3e325e6dbe95f48c1e79a5efc3b62165
SHA1

b5fa2e7ab72f3c7d00de401dfc3edf27e3b0b110
SHA256

dcf57efbef232c43a6f55fb4a45fdc92255e86cac89703fea9eae12f321ca2db
SHA512

8088a94d916f0f768138bbaeeafe7effe034350f92a25d1c5da31fed182c8d887f8fb8e1ca051198ebe11dea07e538b372e996662ee0629104ea8110791796e5
SSDEEP

12288:Myxywa/WsUE7MFyPh8DdWS5TPVrtnw964s:MQBaesUDyLSN9r/

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

dcf57efbef232c43a6f55fb4a45fdc92255e86cac89703fea9eae12f321ca2db.exe

description	pid	process	target process
PID 204 wrote to memory of 1984	204	dcf57efbef232c43a6f55fb4a45fdc92255e86cac89703fea9eae12f321ca2db.exe	dcf57efbef232c43a6f55fb4a45fdc92255e86cac89703fea9eae12f321ca2db.exe
PID 204 wrote to memory of 1984	204	dcf57efbef232c43a6f55fb4a45fdc92255e86cac89703fea9eae12f321ca2db.exe	dcf57efbef232c43a6f55fb4a45fdc92255e86cac89703fea9eae12f321ca2db.exe
PID 204 wrote to memory of 1984	204	dcf57efbef232c43a6f55fb4a45fdc92255e86cac89703fea9eae12f321ca2db.exe	dcf57efbef232c43a6f55fb4a45fdc92255e86cac89703fea9eae12f321ca2db.exe
PID 204 wrote to memory of 3104	204	dcf57efbef232c43a6f55fb4a45fdc92255e86cac89703fea9eae12f321ca2db.exe	dcf57efbef232c43a6f55fb4a45fdc92255e86cac89703fea9eae12f321ca2db.exe
PID 204 wrote to memory of 3104	204	dcf57efbef232c43a6f55fb4a45fdc92255e86cac89703fea9eae12f321ca2db.exe	dcf57efbef232c43a6f55fb4a45fdc92255e86cac89703fea9eae12f321ca2db.exe
PID 204 wrote to memory of 3104	204	dcf57efbef232c43a6f55fb4a45fdc92255e86cac89703fea9eae12f321ca2db.exe	dcf57efbef232c43a6f55fb4a45fdc92255e86cac89703fea9eae12f321ca2db.exe

C:\Users\Admin\AppData\Local\Temp\dcf57efbef232c43a6f55fb4a45fdc92255e86cac89703fea9eae12f321ca2db.exe
"C:\Users\Admin\AppData\Local\Temp\dcf57efbef232c43a6f55fb4a45fdc92255e86cac89703fea9eae12f321ca2db.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:204

C:\Users\Admin\AppData\Local\Temp\dcf57efbef232c43a6f55fb4a45fdc92255e86cac89703fea9eae12f321ca2db.exe
start
2⤵
PID:1984

C:\Users\Admin\AppData\Local\Temp\dcf57efbef232c43a6f55fb4a45fdc92255e86cac89703fea9eae12f321ca2db.exe
watch
2⤵
PID:3104

memory/204-134-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1984-133-0x0000000000000000-mapping.dmp

Download
memory/1984-136-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1984-137-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3104-132-0x0000000000000000-mapping.dmp

Download
memory/3104-135-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3104-138-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download