b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967

Analysis

max time kernel
154s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:57

Target

b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe
Size

526KB
MD5

996d18c0d1badcb43d4b2f14b70279eb
SHA1

7b0642e68282a7751250650f82ed9af9eb3275b8
SHA256

b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967
SHA512

83683e2874844f1fd94ab54036b80937298d693758c1683ce335e63c943d57e50b67a30ebac9dc13ee9ab653553ce7e83b0a90e652c849041b02534ef159f3ea
SSDEEP

12288:sUglNXMpObvp017MBfuEaCzxo4xUupSMrFCsNEfF4SaS:sXbN5fuiG4quouFCsNaHaS

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe

description	pid	process	target process
PID 2004 wrote to memory of 876	2004	b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe	b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe
PID 2004 wrote to memory of 876	2004	b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe	b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe
PID 2004 wrote to memory of 876	2004	b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe	b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe
PID 2004 wrote to memory of 1920	2004	b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe	b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe
PID 2004 wrote to memory of 1920	2004	b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe	b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe
PID 2004 wrote to memory of 1920	2004	b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe	b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe

C:\Users\Admin\AppData\Local\Temp\b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe
"C:\Users\Admin\AppData\Local\Temp\b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2004

C:\Users\Admin\AppData\Local\Temp\b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe
start
2⤵
PID:876

C:\Users\Admin\AppData\Local\Temp\b6f99cc372b8e0233e898f6e3677264d777fbadea233a2cddc37b2e1a17c9967.exe
watch
2⤵
PID:1920

memory/876-134-0x0000000000000000-mapping.dmp

Download
memory/876-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/876-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1920-133-0x0000000000000000-mapping.dmp

Download
memory/1920-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1920-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2004-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2004-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download