c2eb3f3b81cdfcb20e94e1941bed85caed197a60b45872e84ae4cff4f904e58d

Analysis

max time kernel
173s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:55

Target

c2eb3f3b81cdfcb20e94e1941bed85caed197a60b45872e84ae4cff4f904e58d.exe
Size

522KB
MD5

d4c2344235e207f691f3cba32306e342
SHA1

df73bf9e6bfa1556d9412a845b4f7ee6b5f7298b
SHA256

c2eb3f3b81cdfcb20e94e1941bed85caed197a60b45872e84ae4cff4f904e58d
SHA512

f8e10939ec3a64e14c2e8ee3757a92e0122b42f32da374010ac2cff49048231cbd62c4d1b442d808296f2d554176f239dc5188f29532baea19f85b16d265ba0a
SSDEEP

12288:Uk/yIH4xjEDRitJAaWcuzy18xQqpx8O5S:vH4twRitJATatqpx8

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

c2eb3f3b81cdfcb20e94e1941bed85caed197a60b45872e84ae4cff4f904e58d.exe

description	pid	process	target process
PID 332 wrote to memory of 628	332	c2eb3f3b81cdfcb20e94e1941bed85caed197a60b45872e84ae4cff4f904e58d.exe	c2eb3f3b81cdfcb20e94e1941bed85caed197a60b45872e84ae4cff4f904e58d.exe
PID 332 wrote to memory of 628	332	c2eb3f3b81cdfcb20e94e1941bed85caed197a60b45872e84ae4cff4f904e58d.exe	c2eb3f3b81cdfcb20e94e1941bed85caed197a60b45872e84ae4cff4f904e58d.exe
PID 332 wrote to memory of 628	332	c2eb3f3b81cdfcb20e94e1941bed85caed197a60b45872e84ae4cff4f904e58d.exe	c2eb3f3b81cdfcb20e94e1941bed85caed197a60b45872e84ae4cff4f904e58d.exe
PID 332 wrote to memory of 4744	332	c2eb3f3b81cdfcb20e94e1941bed85caed197a60b45872e84ae4cff4f904e58d.exe	c2eb3f3b81cdfcb20e94e1941bed85caed197a60b45872e84ae4cff4f904e58d.exe
PID 332 wrote to memory of 4744	332	c2eb3f3b81cdfcb20e94e1941bed85caed197a60b45872e84ae4cff4f904e58d.exe	c2eb3f3b81cdfcb20e94e1941bed85caed197a60b45872e84ae4cff4f904e58d.exe
PID 332 wrote to memory of 4744	332	c2eb3f3b81cdfcb20e94e1941bed85caed197a60b45872e84ae4cff4f904e58d.exe	c2eb3f3b81cdfcb20e94e1941bed85caed197a60b45872e84ae4cff4f904e58d.exe

C:\Users\Admin\AppData\Local\Temp\c2eb3f3b81cdfcb20e94e1941bed85caed197a60b45872e84ae4cff4f904e58d.exe
"C:\Users\Admin\AppData\Local\Temp\c2eb3f3b81cdfcb20e94e1941bed85caed197a60b45872e84ae4cff4f904e58d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:332

C:\Users\Admin\AppData\Local\Temp\c2eb3f3b81cdfcb20e94e1941bed85caed197a60b45872e84ae4cff4f904e58d.exe
start
2⤵
PID:628

C:\Users\Admin\AppData\Local\Temp\c2eb3f3b81cdfcb20e94e1941bed85caed197a60b45872e84ae4cff4f904e58d.exe
watch
2⤵
PID:4744

memory/332-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/332-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/628-134-0x0000000000000000-mapping.dmp

Download
memory/628-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/628-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/628-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4744-133-0x0000000000000000-mapping.dmp

Download
memory/4744-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4744-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4744-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download