bf71117df0506fcf8f659a931dc37077eaa313c90723e08555bb4a72e3823990

Analysis

max time kernel
91s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:55

Target

bf71117df0506fcf8f659a931dc37077eaa313c90723e08555bb4a72e3823990.exe
Size

522KB
MD5

64953e06b31301fdd209296acd7ac733
SHA1

f0a8589a5bd3c2aea190c8a8463645c179f2bb5e
SHA256

bf71117df0506fcf8f659a931dc37077eaa313c90723e08555bb4a72e3823990
SHA512

1495743ada83b6d453e6089f0c2edbc3270fbe287a55ce41c7c5e91bbd260bf7e2a0a850e97a3a535c72a8014ba5b9026a93c2802e75ab775cfc7d081e32d247
SSDEEP

12288:3/rGnkjjOXXfmry4sHCrpwYYlLPt5oKnWq3Xbz:3/rAUS/GLDmlLPt5/W2z

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

bf71117df0506fcf8f659a931dc37077eaa313c90723e08555bb4a72e3823990.exe

description	pid	process	target process
PID 1632 wrote to memory of 2708	1632	bf71117df0506fcf8f659a931dc37077eaa313c90723e08555bb4a72e3823990.exe	bf71117df0506fcf8f659a931dc37077eaa313c90723e08555bb4a72e3823990.exe
PID 1632 wrote to memory of 2708	1632	bf71117df0506fcf8f659a931dc37077eaa313c90723e08555bb4a72e3823990.exe	bf71117df0506fcf8f659a931dc37077eaa313c90723e08555bb4a72e3823990.exe
PID 1632 wrote to memory of 2708	1632	bf71117df0506fcf8f659a931dc37077eaa313c90723e08555bb4a72e3823990.exe	bf71117df0506fcf8f659a931dc37077eaa313c90723e08555bb4a72e3823990.exe
PID 1632 wrote to memory of 3304	1632	bf71117df0506fcf8f659a931dc37077eaa313c90723e08555bb4a72e3823990.exe	bf71117df0506fcf8f659a931dc37077eaa313c90723e08555bb4a72e3823990.exe
PID 1632 wrote to memory of 3304	1632	bf71117df0506fcf8f659a931dc37077eaa313c90723e08555bb4a72e3823990.exe	bf71117df0506fcf8f659a931dc37077eaa313c90723e08555bb4a72e3823990.exe
PID 1632 wrote to memory of 3304	1632	bf71117df0506fcf8f659a931dc37077eaa313c90723e08555bb4a72e3823990.exe	bf71117df0506fcf8f659a931dc37077eaa313c90723e08555bb4a72e3823990.exe

C:\Users\Admin\AppData\Local\Temp\bf71117df0506fcf8f659a931dc37077eaa313c90723e08555bb4a72e3823990.exe
"C:\Users\Admin\AppData\Local\Temp\bf71117df0506fcf8f659a931dc37077eaa313c90723e08555bb4a72e3823990.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1632

C:\Users\Admin\AppData\Local\Temp\bf71117df0506fcf8f659a931dc37077eaa313c90723e08555bb4a72e3823990.exe
start
2⤵
PID:2708

C:\Users\Admin\AppData\Local\Temp\bf71117df0506fcf8f659a931dc37077eaa313c90723e08555bb4a72e3823990.exe
watch
2⤵
PID:3304

memory/1632-132-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1632-133-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1632-136-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2708-135-0x0000000000000000-mapping.dmp

Download
memory/2708-137-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2708-139-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2708-140-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3304-134-0x0000000000000000-mapping.dmp

Download
memory/3304-138-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3304-141-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download