c6bba8127c79cb763404767b78a007f4e5b7182efbfcb25f4987fcf103476c2c

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:54

Target

c6bba8127c79cb763404767b78a007f4e5b7182efbfcb25f4987fcf103476c2c.exe
Size

518KB
MD5

792f2f4ccf1090e4fc2acdfaa6724303
SHA1

787686b00a402ca762100e2f51a8352421966ea6
SHA256

c6bba8127c79cb763404767b78a007f4e5b7182efbfcb25f4987fcf103476c2c
SHA512

16b2936f6544b43a4143ac8a07f1000b10bd6350263c2a01f86831c193243c7f272c3c192ed5d008e007b774c526922341a17b630c24af4eef331dfaac705a70
SSDEEP

6144:dGCyjrhTII2nwYhXfk5I7kXEXSUW2FORaOoxHMrYlw75G9+lLPX9MM8e459KOoWU:dG9Rn2wgOo4JolRwYYlLPt5oKnWq3hb

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

c6bba8127c79cb763404767b78a007f4e5b7182efbfcb25f4987fcf103476c2c.exe

description	pid	process	target process
PID 4656 wrote to memory of 2848	4656	c6bba8127c79cb763404767b78a007f4e5b7182efbfcb25f4987fcf103476c2c.exe	c6bba8127c79cb763404767b78a007f4e5b7182efbfcb25f4987fcf103476c2c.exe
PID 4656 wrote to memory of 2848	4656	c6bba8127c79cb763404767b78a007f4e5b7182efbfcb25f4987fcf103476c2c.exe	c6bba8127c79cb763404767b78a007f4e5b7182efbfcb25f4987fcf103476c2c.exe
PID 4656 wrote to memory of 2848	4656	c6bba8127c79cb763404767b78a007f4e5b7182efbfcb25f4987fcf103476c2c.exe	c6bba8127c79cb763404767b78a007f4e5b7182efbfcb25f4987fcf103476c2c.exe
PID 4656 wrote to memory of 2604	4656	c6bba8127c79cb763404767b78a007f4e5b7182efbfcb25f4987fcf103476c2c.exe	c6bba8127c79cb763404767b78a007f4e5b7182efbfcb25f4987fcf103476c2c.exe
PID 4656 wrote to memory of 2604	4656	c6bba8127c79cb763404767b78a007f4e5b7182efbfcb25f4987fcf103476c2c.exe	c6bba8127c79cb763404767b78a007f4e5b7182efbfcb25f4987fcf103476c2c.exe
PID 4656 wrote to memory of 2604	4656	c6bba8127c79cb763404767b78a007f4e5b7182efbfcb25f4987fcf103476c2c.exe	c6bba8127c79cb763404767b78a007f4e5b7182efbfcb25f4987fcf103476c2c.exe

C:\Users\Admin\AppData\Local\Temp\c6bba8127c79cb763404767b78a007f4e5b7182efbfcb25f4987fcf103476c2c.exe
"C:\Users\Admin\AppData\Local\Temp\c6bba8127c79cb763404767b78a007f4e5b7182efbfcb25f4987fcf103476c2c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4656

C:\Users\Admin\AppData\Local\Temp\c6bba8127c79cb763404767b78a007f4e5b7182efbfcb25f4987fcf103476c2c.exe
start
2⤵
PID:2848

C:\Users\Admin\AppData\Local\Temp\c6bba8127c79cb763404767b78a007f4e5b7182efbfcb25f4987fcf103476c2c.exe
watch
2⤵
PID:2604

memory/2604-134-0x0000000000000000-mapping.dmp

Download
memory/2604-138-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2604-140-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2848-135-0x0000000000000000-mapping.dmp

Download
memory/2848-137-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2848-139-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4656-132-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4656-133-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4656-136-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download