b5ff4e3fd739d64837d3ce980e98942c7cea6c6a27ceb15131642b9ef06dea04

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:57

Target

b5ff4e3fd739d64837d3ce980e98942c7cea6c6a27ceb15131642b9ef06dea04.exe
Size

526KB
MD5

860633b8092205f72e9811d1830db3a5
SHA1

9d2cdef0c2fa320b11e2bcd5c7a90c749f027406
SHA256

b5ff4e3fd739d64837d3ce980e98942c7cea6c6a27ceb15131642b9ef06dea04
SHA512

ec1f55c7d5b485f5705d26177fd597f308e49f88ec3c2d5a6b2056a3f9a7a61cd0892948611c28773d1aa58f9d4b30c4a2376588725e96eb2a01f51c6ebd2a3f
SSDEEP

6144:TDptT5PsgNgtLm1wfv+FPhNgejS4oTuhtsQEXpZwK6omQy1CrxQqD9RSaSz+8O5n:HZDmEFhNgeeHXb6ky18xQqpx8O5PP

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

b5ff4e3fd739d64837d3ce980e98942c7cea6c6a27ceb15131642b9ef06dea04.exe

description	pid	process	target process
PID 2564 wrote to memory of 3768	2564	b5ff4e3fd739d64837d3ce980e98942c7cea6c6a27ceb15131642b9ef06dea04.exe	b5ff4e3fd739d64837d3ce980e98942c7cea6c6a27ceb15131642b9ef06dea04.exe
PID 2564 wrote to memory of 3768	2564	b5ff4e3fd739d64837d3ce980e98942c7cea6c6a27ceb15131642b9ef06dea04.exe	b5ff4e3fd739d64837d3ce980e98942c7cea6c6a27ceb15131642b9ef06dea04.exe
PID 2564 wrote to memory of 3768	2564	b5ff4e3fd739d64837d3ce980e98942c7cea6c6a27ceb15131642b9ef06dea04.exe	b5ff4e3fd739d64837d3ce980e98942c7cea6c6a27ceb15131642b9ef06dea04.exe
PID 2564 wrote to memory of 2584	2564	b5ff4e3fd739d64837d3ce980e98942c7cea6c6a27ceb15131642b9ef06dea04.exe	b5ff4e3fd739d64837d3ce980e98942c7cea6c6a27ceb15131642b9ef06dea04.exe
PID 2564 wrote to memory of 2584	2564	b5ff4e3fd739d64837d3ce980e98942c7cea6c6a27ceb15131642b9ef06dea04.exe	b5ff4e3fd739d64837d3ce980e98942c7cea6c6a27ceb15131642b9ef06dea04.exe
PID 2564 wrote to memory of 2584	2564	b5ff4e3fd739d64837d3ce980e98942c7cea6c6a27ceb15131642b9ef06dea04.exe	b5ff4e3fd739d64837d3ce980e98942c7cea6c6a27ceb15131642b9ef06dea04.exe

C:\Users\Admin\AppData\Local\Temp\b5ff4e3fd739d64837d3ce980e98942c7cea6c6a27ceb15131642b9ef06dea04.exe
"C:\Users\Admin\AppData\Local\Temp\b5ff4e3fd739d64837d3ce980e98942c7cea6c6a27ceb15131642b9ef06dea04.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Users\Admin\AppData\Local\Temp\b5ff4e3fd739d64837d3ce980e98942c7cea6c6a27ceb15131642b9ef06dea04.exe
  start
  2⤵
  PID:3768
- C:\Users\Admin\AppData\Local\Temp\b5ff4e3fd739d64837d3ce980e98942c7cea6c6a27ceb15131642b9ef06dea04.exe
  watch
  2⤵
  PID:2584

memory/2564-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2564-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2584-133-0x0000000000000000-mapping.dmp

Download
memory/2584-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2584-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2584-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3768-134-0x0000000000000000-mapping.dmp

Download
memory/3768-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3768-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3768-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download