a81c1a40cdd6f36064dd239e01fedfdb1a79e4584fe42191743587a3b3758c88

Analysis

max time kernel
122s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:59

Target

a81c1a40cdd6f36064dd239e01fedfdb1a79e4584fe42191743587a3b3758c88.exe
Size

522KB
MD5

830bd2ca58049d7c4869296d27ac3886
SHA1

a5268b430c738a331c5e395ce2b0ef1e883650c5
SHA256

a81c1a40cdd6f36064dd239e01fedfdb1a79e4584fe42191743587a3b3758c88
SHA512

c9c6cf396c6803c6c7dc54ae4d49b8600db9bc7a34ef6818274ce3df59933e484bfdcbe77cc07ae660d0e38872c291f57bf015e5b4ef82809cc47638ecea2ad0
SSDEEP

12288:p04gl7e3RXrAWVq4FG+UPeXwYYlLPt5oKnWq3vXTbp:CZJeBb1qBlLPt5/WU/p

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

a81c1a40cdd6f36064dd239e01fedfdb1a79e4584fe42191743587a3b3758c88.exe

description	pid	process	target process
PID 4972 wrote to memory of 3984	4972	a81c1a40cdd6f36064dd239e01fedfdb1a79e4584fe42191743587a3b3758c88.exe	a81c1a40cdd6f36064dd239e01fedfdb1a79e4584fe42191743587a3b3758c88.exe
PID 4972 wrote to memory of 3984	4972	a81c1a40cdd6f36064dd239e01fedfdb1a79e4584fe42191743587a3b3758c88.exe	a81c1a40cdd6f36064dd239e01fedfdb1a79e4584fe42191743587a3b3758c88.exe
PID 4972 wrote to memory of 3984	4972	a81c1a40cdd6f36064dd239e01fedfdb1a79e4584fe42191743587a3b3758c88.exe	a81c1a40cdd6f36064dd239e01fedfdb1a79e4584fe42191743587a3b3758c88.exe
PID 4972 wrote to memory of 4472	4972	a81c1a40cdd6f36064dd239e01fedfdb1a79e4584fe42191743587a3b3758c88.exe	a81c1a40cdd6f36064dd239e01fedfdb1a79e4584fe42191743587a3b3758c88.exe
PID 4972 wrote to memory of 4472	4972	a81c1a40cdd6f36064dd239e01fedfdb1a79e4584fe42191743587a3b3758c88.exe	a81c1a40cdd6f36064dd239e01fedfdb1a79e4584fe42191743587a3b3758c88.exe
PID 4972 wrote to memory of 4472	4972	a81c1a40cdd6f36064dd239e01fedfdb1a79e4584fe42191743587a3b3758c88.exe	a81c1a40cdd6f36064dd239e01fedfdb1a79e4584fe42191743587a3b3758c88.exe

C:\Users\Admin\AppData\Local\Temp\a81c1a40cdd6f36064dd239e01fedfdb1a79e4584fe42191743587a3b3758c88.exe
"C:\Users\Admin\AppData\Local\Temp\a81c1a40cdd6f36064dd239e01fedfdb1a79e4584fe42191743587a3b3758c88.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Users\Admin\AppData\Local\Temp\a81c1a40cdd6f36064dd239e01fedfdb1a79e4584fe42191743587a3b3758c88.exe
  start
  2⤵
  PID:3984
- C:\Users\Admin\AppData\Local\Temp\a81c1a40cdd6f36064dd239e01fedfdb1a79e4584fe42191743587a3b3758c88.exe
  watch
  2⤵
  PID:4472

memory/3984-134-0x0000000000000000-mapping.dmp

Download
memory/3984-137-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3984-139-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3984-141-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3984-142-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4472-133-0x0000000000000000-mapping.dmp

Download
memory/4472-136-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4472-138-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4472-140-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4472-143-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4972-132-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4972-135-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download