b3a4900e5d4298b4df26f7f2b0434e352096f5c23c7ee4144cf713c18730bd93

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:58

Target

b3a4900e5d4298b4df26f7f2b0434e352096f5c23c7ee4144cf713c18730bd93.exe
Size

522KB
MD5

d183f6a728263f953924cece7eb11f63
SHA1

b7d49aa5a5c289ac927d8f4e5e538ed9bd2aa7d0
SHA256

b3a4900e5d4298b4df26f7f2b0434e352096f5c23c7ee4144cf713c18730bd93
SHA512

29f886d7703275e47d355fd76d01caff6f8658c410612cbd576c8aaada698e2ced395f6318ed69bebf9a2b765e45efc1c2ef4ff4dd79b0890635d6d71574ef63
SSDEEP

6144:C9ELjD9c87ywLd6L81UZI5cJlrCNZo9Rn1wyGjgYQenOFmQy1CrxQqD9RSaSz+8l:xjDOKLdeTlioD8jgYR0y18xQqpx8O5N

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

b3a4900e5d4298b4df26f7f2b0434e352096f5c23c7ee4144cf713c18730bd93.exe

description	pid	process	target process
PID 2204 wrote to memory of 1252	2204	b3a4900e5d4298b4df26f7f2b0434e352096f5c23c7ee4144cf713c18730bd93.exe	b3a4900e5d4298b4df26f7f2b0434e352096f5c23c7ee4144cf713c18730bd93.exe
PID 2204 wrote to memory of 1252	2204	b3a4900e5d4298b4df26f7f2b0434e352096f5c23c7ee4144cf713c18730bd93.exe	b3a4900e5d4298b4df26f7f2b0434e352096f5c23c7ee4144cf713c18730bd93.exe
PID 2204 wrote to memory of 1252	2204	b3a4900e5d4298b4df26f7f2b0434e352096f5c23c7ee4144cf713c18730bd93.exe	b3a4900e5d4298b4df26f7f2b0434e352096f5c23c7ee4144cf713c18730bd93.exe
PID 2204 wrote to memory of 2164	2204	b3a4900e5d4298b4df26f7f2b0434e352096f5c23c7ee4144cf713c18730bd93.exe	b3a4900e5d4298b4df26f7f2b0434e352096f5c23c7ee4144cf713c18730bd93.exe
PID 2204 wrote to memory of 2164	2204	b3a4900e5d4298b4df26f7f2b0434e352096f5c23c7ee4144cf713c18730bd93.exe	b3a4900e5d4298b4df26f7f2b0434e352096f5c23c7ee4144cf713c18730bd93.exe
PID 2204 wrote to memory of 2164	2204	b3a4900e5d4298b4df26f7f2b0434e352096f5c23c7ee4144cf713c18730bd93.exe	b3a4900e5d4298b4df26f7f2b0434e352096f5c23c7ee4144cf713c18730bd93.exe

C:\Users\Admin\AppData\Local\Temp\b3a4900e5d4298b4df26f7f2b0434e352096f5c23c7ee4144cf713c18730bd93.exe
"C:\Users\Admin\AppData\Local\Temp\b3a4900e5d4298b4df26f7f2b0434e352096f5c23c7ee4144cf713c18730bd93.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2204

C:\Users\Admin\AppData\Local\Temp\b3a4900e5d4298b4df26f7f2b0434e352096f5c23c7ee4144cf713c18730bd93.exe
start
2⤵
PID:1252

C:\Users\Admin\AppData\Local\Temp\b3a4900e5d4298b4df26f7f2b0434e352096f5c23c7ee4144cf713c18730bd93.exe
watch
2⤵
PID:2164

memory/1252-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1252-143-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1252-134-0x0000000000000000-mapping.dmp

Download
memory/1252-142-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1252-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2164-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2164-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2164-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2164-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2164-133-0x0000000000000000-mapping.dmp

Download
memory/2164-144-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2204-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2204-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download