cf891776bcdd4fe8a005a165e4816b88ea375d277ae2270e24d2f1c20e643d78

Analysis

max time kernel
179s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:53

Target

cf891776bcdd4fe8a005a165e4816b88ea375d277ae2270e24d2f1c20e643d78.exe
Size

535KB
MD5

53460c56949b825f87faa6cca200839e
SHA1

8b4a524ac895c864525c8cf4bcc7ef88c22bb032
SHA256

cf891776bcdd4fe8a005a165e4816b88ea375d277ae2270e24d2f1c20e643d78
SHA512

5f8f1a2d6ed6c8420ecc24306044ba74a7ef89436133b10a64fd41b0c64ad49eb24477cecaef2e4a56adde70ba5d94f23ee2cd11006a87d3975ed21cab5289b4
SSDEEP

12288:LiZak2Zvp77Z8R+DmQQI5tn5Vk/w3xus16h+YzpljdR0:Lpx777SR+KQQwnS0X16EMPjQ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cf891776bcdd4fe8a005a165e4816b88ea375d277ae2270e24d2f1c20e643d78.exe

description	pid	process	target process
PID 3472 wrote to memory of 960	3472	cf891776bcdd4fe8a005a165e4816b88ea375d277ae2270e24d2f1c20e643d78.exe	cf891776bcdd4fe8a005a165e4816b88ea375d277ae2270e24d2f1c20e643d78.exe
PID 3472 wrote to memory of 960	3472	cf891776bcdd4fe8a005a165e4816b88ea375d277ae2270e24d2f1c20e643d78.exe	cf891776bcdd4fe8a005a165e4816b88ea375d277ae2270e24d2f1c20e643d78.exe
PID 3472 wrote to memory of 960	3472	cf891776bcdd4fe8a005a165e4816b88ea375d277ae2270e24d2f1c20e643d78.exe	cf891776bcdd4fe8a005a165e4816b88ea375d277ae2270e24d2f1c20e643d78.exe

C:\Users\Admin\AppData\Local\Temp\cf891776bcdd4fe8a005a165e4816b88ea375d277ae2270e24d2f1c20e643d78.exe
"C:\Users\Admin\AppData\Local\Temp\cf891776bcdd4fe8a005a165e4816b88ea375d277ae2270e24d2f1c20e643d78.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3472

C:\Users\Admin\AppData\Local\Temp\cf891776bcdd4fe8a005a165e4816b88ea375d277ae2270e24d2f1c20e643d78.exe
tear
2⤵
PID:960

memory/960-133-0x0000000000000000-mapping.dmp

Download
memory/960-135-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/960-136-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/960-137-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/960-138-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/3472-132-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/3472-134-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download