de6fae34e3b61ed378da35d53d269d6cec2eb0d9e3c42ed4fa6841bd2f82d10f

Analysis

max time kernel
201s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:51

Target

de6fae34e3b61ed378da35d53d269d6cec2eb0d9e3c42ed4fa6841bd2f82d10f.exe
Size

522KB
MD5

1f132e7566ccd2ff86f51ab17a3569e6
SHA1

4ea176308731d24bc896d5b52e0cfd6f1b59d6db
SHA256

de6fae34e3b61ed378da35d53d269d6cec2eb0d9e3c42ed4fa6841bd2f82d10f
SHA512

946486041102994ea186a3e955c1df73d853846b79d0be8216b707256dba6fb2e8d79802de08e6953b6acaad89f6f020566c1acb7a4a3ac27c1ebfb249c0a022
SSDEEP

12288:0Cb7wPwC6+qMT6mkwYYlLPt5oKnWq3kbDZ:pKS+JX1lLPt5/WlDZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

de6fae34e3b61ed378da35d53d269d6cec2eb0d9e3c42ed4fa6841bd2f82d10f.exe

description	pid	process	target process
PID 4004 wrote to memory of 1856	4004	de6fae34e3b61ed378da35d53d269d6cec2eb0d9e3c42ed4fa6841bd2f82d10f.exe	de6fae34e3b61ed378da35d53d269d6cec2eb0d9e3c42ed4fa6841bd2f82d10f.exe
PID 4004 wrote to memory of 1856	4004	de6fae34e3b61ed378da35d53d269d6cec2eb0d9e3c42ed4fa6841bd2f82d10f.exe	de6fae34e3b61ed378da35d53d269d6cec2eb0d9e3c42ed4fa6841bd2f82d10f.exe
PID 4004 wrote to memory of 1856	4004	de6fae34e3b61ed378da35d53d269d6cec2eb0d9e3c42ed4fa6841bd2f82d10f.exe	de6fae34e3b61ed378da35d53d269d6cec2eb0d9e3c42ed4fa6841bd2f82d10f.exe

C:\Users\Admin\AppData\Local\Temp\de6fae34e3b61ed378da35d53d269d6cec2eb0d9e3c42ed4fa6841bd2f82d10f.exe
"C:\Users\Admin\AppData\Local\Temp\de6fae34e3b61ed378da35d53d269d6cec2eb0d9e3c42ed4fa6841bd2f82d10f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Users\Admin\AppData\Local\Temp\de6fae34e3b61ed378da35d53d269d6cec2eb0d9e3c42ed4fa6841bd2f82d10f.exe
  tear
  2⤵
  PID:1856

memory/1856-133-0x0000000000000000-mapping.dmp

Download
memory/1856-135-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1856-136-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1856-137-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1856-138-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4004-132-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4004-134-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download