aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a

Analysis

max time kernel
189s
max time network
196s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:59

Target

aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe
Size

522KB
MD5

3d3a43cbfd169bcb0d21f9cc6ed904e2
SHA1

f968e1dc9638e50a508795e265eb037f213365b9
SHA256

aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a
SHA512

1d0a5ada165313aaec30002f8b4ea92454d985ae2d6f9568ba4db5a5d305e4f94be5b2c529c90c80ebc5a3b0dcebad38d2c02bc71fbfd9f1e65f5bce8aba6ede
SSDEEP

6144:pUi8YVAnOl86HLijp02Zb21HiwodmPCGl5yDyzOmQy1CrxQqD9RSaSz+8O5yl:382nGr5ZmPyy18xQqpx8O5y

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe

description	pid	process	target process
PID 732 wrote to memory of 1460	732	aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe	aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe
PID 732 wrote to memory of 1460	732	aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe	aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe
PID 732 wrote to memory of 1460	732	aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe	aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe
PID 732 wrote to memory of 1976	732	aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe	aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe
PID 732 wrote to memory of 1976	732	aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe	aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe
PID 732 wrote to memory of 1976	732	aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe	aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe

C:\Users\Admin\AppData\Local\Temp\aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe
"C:\Users\Admin\AppData\Local\Temp\aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:732
- C:\Users\Admin\AppData\Local\Temp\aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe
  start
  2⤵
  PID:1460
- C:\Users\Admin\AppData\Local\Temp\aba43815b5a2b0a8ec475f896b74a7d7fae42960cf891eda86adc84b4146e54a.exe
  watch
  2⤵
  PID:1976

memory/732-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/732-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1460-134-0x0000000000000000-mapping.dmp

Download
memory/1460-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1460-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1460-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1976-133-0x0000000000000000-mapping.dmp

Download
memory/1976-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1976-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1976-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download