cbd95b73aa29e6224ae3488c9cb6b7455b182c7d999fcfd056420ffcd4d34784

Analysis

max time kernel
144s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:54

Target

cbd95b73aa29e6224ae3488c9cb6b7455b182c7d999fcfd056420ffcd4d34784.exe
Size

518KB
MD5

c972d0062b6ba27bd5660f009f739c7d
SHA1

6428915e39c02a3b444c66ec8fe5b00be311aa79
SHA256

cbd95b73aa29e6224ae3488c9cb6b7455b182c7d999fcfd056420ffcd4d34784
SHA512

51c0dd96a0a99a27c8f191b5f154596e640d23cd34bb1da1d04471dab9f220793519d97a109a3ee8befb4eff68758b9df4a7b33734c6d8663572176b101c5ede
SSDEEP

12288:mGR/vNWtYsve7Oormy64d6wYYlLPt5oKnWq3/yb:m4/lFsve3q4d7lLPt5/Wj

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

cbd95b73aa29e6224ae3488c9cb6b7455b182c7d999fcfd056420ffcd4d34784.exe

description	pid	process	target process
PID 2608 wrote to memory of 1292	2608	cbd95b73aa29e6224ae3488c9cb6b7455b182c7d999fcfd056420ffcd4d34784.exe	cbd95b73aa29e6224ae3488c9cb6b7455b182c7d999fcfd056420ffcd4d34784.exe
PID 2608 wrote to memory of 1292	2608	cbd95b73aa29e6224ae3488c9cb6b7455b182c7d999fcfd056420ffcd4d34784.exe	cbd95b73aa29e6224ae3488c9cb6b7455b182c7d999fcfd056420ffcd4d34784.exe
PID 2608 wrote to memory of 1292	2608	cbd95b73aa29e6224ae3488c9cb6b7455b182c7d999fcfd056420ffcd4d34784.exe	cbd95b73aa29e6224ae3488c9cb6b7455b182c7d999fcfd056420ffcd4d34784.exe
PID 2608 wrote to memory of 2000	2608	cbd95b73aa29e6224ae3488c9cb6b7455b182c7d999fcfd056420ffcd4d34784.exe	cbd95b73aa29e6224ae3488c9cb6b7455b182c7d999fcfd056420ffcd4d34784.exe
PID 2608 wrote to memory of 2000	2608	cbd95b73aa29e6224ae3488c9cb6b7455b182c7d999fcfd056420ffcd4d34784.exe	cbd95b73aa29e6224ae3488c9cb6b7455b182c7d999fcfd056420ffcd4d34784.exe
PID 2608 wrote to memory of 2000	2608	cbd95b73aa29e6224ae3488c9cb6b7455b182c7d999fcfd056420ffcd4d34784.exe	cbd95b73aa29e6224ae3488c9cb6b7455b182c7d999fcfd056420ffcd4d34784.exe

C:\Users\Admin\AppData\Local\Temp\cbd95b73aa29e6224ae3488c9cb6b7455b182c7d999fcfd056420ffcd4d34784.exe
"C:\Users\Admin\AppData\Local\Temp\cbd95b73aa29e6224ae3488c9cb6b7455b182c7d999fcfd056420ffcd4d34784.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2608

C:\Users\Admin\AppData\Local\Temp\cbd95b73aa29e6224ae3488c9cb6b7455b182c7d999fcfd056420ffcd4d34784.exe
start
2⤵
PID:1292

C:\Users\Admin\AppData\Local\Temp\cbd95b73aa29e6224ae3488c9cb6b7455b182c7d999fcfd056420ffcd4d34784.exe
watch
2⤵
PID:2000

memory/1292-134-0x0000000000000000-mapping.dmp

Download
memory/1292-136-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1292-138-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1292-140-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2000-133-0x0000000000000000-mapping.dmp

Download
memory/2000-137-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2000-139-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2000-141-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2608-132-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2608-135-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download