ba8be232176e3968e45c7ea7f0c7c70b9151e4b65c76866a4fbc7dfc4c2a4698

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:56

Target

ba8be232176e3968e45c7ea7f0c7c70b9151e4b65c76866a4fbc7dfc4c2a4698.exe
Size

526KB
MD5

8219aa42f82377b117177776fb4bb564
SHA1

44100e78e333ace51b999bef2297975fe785f816
SHA256

ba8be232176e3968e45c7ea7f0c7c70b9151e4b65c76866a4fbc7dfc4c2a4698
SHA512

b115061dac691df588e963756d860918a06cc2a0e802a73d059150bd5f3fc226dfc831f03c90e02ad36db11576d9ff0744a5ea1656d0c8af0aaedcae2984f54d
SSDEEP

6144:gHiAWc7vF3qGiwi91F9J44C81YYPoxWiyjMrxgcri0nmQy1CrxQqD9RSaSz+8O5+:eDWayugUZhri0ty18xQqpx8O5mH

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

ba8be232176e3968e45c7ea7f0c7c70b9151e4b65c76866a4fbc7dfc4c2a4698.exe

description	pid	process	target process
PID 2500 wrote to memory of 4976	2500	ba8be232176e3968e45c7ea7f0c7c70b9151e4b65c76866a4fbc7dfc4c2a4698.exe	ba8be232176e3968e45c7ea7f0c7c70b9151e4b65c76866a4fbc7dfc4c2a4698.exe
PID 2500 wrote to memory of 4976	2500	ba8be232176e3968e45c7ea7f0c7c70b9151e4b65c76866a4fbc7dfc4c2a4698.exe	ba8be232176e3968e45c7ea7f0c7c70b9151e4b65c76866a4fbc7dfc4c2a4698.exe
PID 2500 wrote to memory of 4976	2500	ba8be232176e3968e45c7ea7f0c7c70b9151e4b65c76866a4fbc7dfc4c2a4698.exe	ba8be232176e3968e45c7ea7f0c7c70b9151e4b65c76866a4fbc7dfc4c2a4698.exe
PID 2500 wrote to memory of 4980	2500	ba8be232176e3968e45c7ea7f0c7c70b9151e4b65c76866a4fbc7dfc4c2a4698.exe	ba8be232176e3968e45c7ea7f0c7c70b9151e4b65c76866a4fbc7dfc4c2a4698.exe
PID 2500 wrote to memory of 4980	2500	ba8be232176e3968e45c7ea7f0c7c70b9151e4b65c76866a4fbc7dfc4c2a4698.exe	ba8be232176e3968e45c7ea7f0c7c70b9151e4b65c76866a4fbc7dfc4c2a4698.exe
PID 2500 wrote to memory of 4980	2500	ba8be232176e3968e45c7ea7f0c7c70b9151e4b65c76866a4fbc7dfc4c2a4698.exe	ba8be232176e3968e45c7ea7f0c7c70b9151e4b65c76866a4fbc7dfc4c2a4698.exe

C:\Users\Admin\AppData\Local\Temp\ba8be232176e3968e45c7ea7f0c7c70b9151e4b65c76866a4fbc7dfc4c2a4698.exe
"C:\Users\Admin\AppData\Local\Temp\ba8be232176e3968e45c7ea7f0c7c70b9151e4b65c76866a4fbc7dfc4c2a4698.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Users\Admin\AppData\Local\Temp\ba8be232176e3968e45c7ea7f0c7c70b9151e4b65c76866a4fbc7dfc4c2a4698.exe
  start
  2⤵
  PID:4976
- C:\Users\Admin\AppData\Local\Temp\ba8be232176e3968e45c7ea7f0c7c70b9151e4b65c76866a4fbc7dfc4c2a4698.exe
  watch
  2⤵
  PID:4980

memory/2500-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2500-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4976-134-0x0000000000000000-mapping.dmp

Download
memory/4976-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4976-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4976-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4976-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4980-133-0x0000000000000000-mapping.dmp

Download
memory/4980-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4980-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4980-142-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download