c339fa1ea8e35414e4445e7b68208472a6da6fb8095e7942f9f097a94e030135

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:55

Target

c339fa1ea8e35414e4445e7b68208472a6da6fb8095e7942f9f097a94e030135.exe
Size

518KB
MD5

bf53d9be1f2eff7dad10713aeea854f1
SHA1

bc541c721003293617839fdcb683fea323df4c97
SHA256

c339fa1ea8e35414e4445e7b68208472a6da6fb8095e7942f9f097a94e030135
SHA512

a6743678f0c2c6981ded113d028a5c25272ba9a87e0ce08c65b207603a1d990171c1ed3684fffb8993eea8842238069407dde4dd18db6c4158c4a5cab740f729
SSDEEP

12288:RyEqZ+jm4WEJ4XQ0g8twYYlLPt5oKnWq3Vzb:s2WC4zg8alLPt5/WwP

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

c339fa1ea8e35414e4445e7b68208472a6da6fb8095e7942f9f097a94e030135.exe

description	pid	process	target process
PID 488 wrote to memory of 5040	488	c339fa1ea8e35414e4445e7b68208472a6da6fb8095e7942f9f097a94e030135.exe	c339fa1ea8e35414e4445e7b68208472a6da6fb8095e7942f9f097a94e030135.exe
PID 488 wrote to memory of 5040	488	c339fa1ea8e35414e4445e7b68208472a6da6fb8095e7942f9f097a94e030135.exe	c339fa1ea8e35414e4445e7b68208472a6da6fb8095e7942f9f097a94e030135.exe
PID 488 wrote to memory of 5040	488	c339fa1ea8e35414e4445e7b68208472a6da6fb8095e7942f9f097a94e030135.exe	c339fa1ea8e35414e4445e7b68208472a6da6fb8095e7942f9f097a94e030135.exe
PID 488 wrote to memory of 4944	488	c339fa1ea8e35414e4445e7b68208472a6da6fb8095e7942f9f097a94e030135.exe	c339fa1ea8e35414e4445e7b68208472a6da6fb8095e7942f9f097a94e030135.exe
PID 488 wrote to memory of 4944	488	c339fa1ea8e35414e4445e7b68208472a6da6fb8095e7942f9f097a94e030135.exe	c339fa1ea8e35414e4445e7b68208472a6da6fb8095e7942f9f097a94e030135.exe
PID 488 wrote to memory of 4944	488	c339fa1ea8e35414e4445e7b68208472a6da6fb8095e7942f9f097a94e030135.exe	c339fa1ea8e35414e4445e7b68208472a6da6fb8095e7942f9f097a94e030135.exe

C:\Users\Admin\AppData\Local\Temp\c339fa1ea8e35414e4445e7b68208472a6da6fb8095e7942f9f097a94e030135.exe
"C:\Users\Admin\AppData\Local\Temp\c339fa1ea8e35414e4445e7b68208472a6da6fb8095e7942f9f097a94e030135.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:488

C:\Users\Admin\AppData\Local\Temp\c339fa1ea8e35414e4445e7b68208472a6da6fb8095e7942f9f097a94e030135.exe
start
2⤵
PID:5040

C:\Users\Admin\AppData\Local\Temp\c339fa1ea8e35414e4445e7b68208472a6da6fb8095e7942f9f097a94e030135.exe
watch
2⤵
PID:4944

memory/488-132-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/488-135-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4944-133-0x0000000000000000-mapping.dmp

Download
memory/4944-136-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4944-138-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4944-141-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/5040-134-0x0000000000000000-mapping.dmp

Download
memory/5040-137-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/5040-139-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/5040-140-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download