dee60e3d3e912fa665a2ea357b9a447508b63929cd8d80a03285354e83f4b7bf

Analysis

max time kernel
140s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:51

Target

dee60e3d3e912fa665a2ea357b9a447508b63929cd8d80a03285354e83f4b7bf.exe
Size

522KB
MD5

b207f14403c11c25c358bbdc77fd673c
SHA1

8a7d815257044810191bb32f2d63647f6fb9ada7
SHA256

dee60e3d3e912fa665a2ea357b9a447508b63929cd8d80a03285354e83f4b7bf
SHA512

ec5855e1c551a6ccae3a9a70596827fe57b8275b5d0b43fdaaed0cd9cca2786584b299763dd6bfce60c3dc1440ba010d1c64025ff2aad07365abc6d863784fa0
SSDEEP

6144:Kx+qeTH+BjqRMD/+dgfDMjYIe0/fML39CWmQy1CrxQqD9RSaSz+8O5EfzW:fHOU/dgme1y18xQqpx8O5Er

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

dee60e3d3e912fa665a2ea357b9a447508b63929cd8d80a03285354e83f4b7bf.exe

description	pid	process	target process
PID 4800 wrote to memory of 4852	4800	dee60e3d3e912fa665a2ea357b9a447508b63929cd8d80a03285354e83f4b7bf.exe	dee60e3d3e912fa665a2ea357b9a447508b63929cd8d80a03285354e83f4b7bf.exe
PID 4800 wrote to memory of 4852	4800	dee60e3d3e912fa665a2ea357b9a447508b63929cd8d80a03285354e83f4b7bf.exe	dee60e3d3e912fa665a2ea357b9a447508b63929cd8d80a03285354e83f4b7bf.exe
PID 4800 wrote to memory of 4852	4800	dee60e3d3e912fa665a2ea357b9a447508b63929cd8d80a03285354e83f4b7bf.exe	dee60e3d3e912fa665a2ea357b9a447508b63929cd8d80a03285354e83f4b7bf.exe
PID 4800 wrote to memory of 4760	4800	dee60e3d3e912fa665a2ea357b9a447508b63929cd8d80a03285354e83f4b7bf.exe	dee60e3d3e912fa665a2ea357b9a447508b63929cd8d80a03285354e83f4b7bf.exe
PID 4800 wrote to memory of 4760	4800	dee60e3d3e912fa665a2ea357b9a447508b63929cd8d80a03285354e83f4b7bf.exe	dee60e3d3e912fa665a2ea357b9a447508b63929cd8d80a03285354e83f4b7bf.exe
PID 4800 wrote to memory of 4760	4800	dee60e3d3e912fa665a2ea357b9a447508b63929cd8d80a03285354e83f4b7bf.exe	dee60e3d3e912fa665a2ea357b9a447508b63929cd8d80a03285354e83f4b7bf.exe

C:\Users\Admin\AppData\Local\Temp\dee60e3d3e912fa665a2ea357b9a447508b63929cd8d80a03285354e83f4b7bf.exe
"C:\Users\Admin\AppData\Local\Temp\dee60e3d3e912fa665a2ea357b9a447508b63929cd8d80a03285354e83f4b7bf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4800

C:\Users\Admin\AppData\Local\Temp\dee60e3d3e912fa665a2ea357b9a447508b63929cd8d80a03285354e83f4b7bf.exe
start
2⤵
PID:4852

C:\Users\Admin\AppData\Local\Temp\dee60e3d3e912fa665a2ea357b9a447508b63929cd8d80a03285354e83f4b7bf.exe
watch
2⤵
PID:4760

memory/4760-133-0x0000000000000000-mapping.dmp

Download
memory/4760-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4760-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4760-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4800-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4800-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4852-134-0x0000000000000000-mapping.dmp

Download
memory/4852-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4852-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4852-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download