9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc

Analysis

max time kernel
193s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:01

Target

9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe
Size

522KB
MD5

5a12e0f5f3230a4385b83e35da08ff40
SHA1

9d55ff9864381704812b20eea711c7c748143d3b
SHA256

9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc
SHA512

355c6e3c9a1251d01dbdc3c18e524d11c4fb9429307ff66fd46a3d735f9772ccaa5065c3c0b2c3fd046bb1c18679cfa86102eef774d3792f76f071dc589e809a
SSDEEP

12288:PbVepIab8IQ5LBGI4fmgy18xQqpx8O5TF:heCG8IQ5VGnatqpx8

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe

description	pid	process	target process
PID 4328 wrote to memory of 1540	4328	9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe	9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe
PID 4328 wrote to memory of 1540	4328	9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe	9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe
PID 4328 wrote to memory of 1540	4328	9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe	9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe
PID 4328 wrote to memory of 424	4328	9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe	9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe
PID 4328 wrote to memory of 424	4328	9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe	9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe
PID 4328 wrote to memory of 424	4328	9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe	9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe

C:\Users\Admin\AppData\Local\Temp\9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe
"C:\Users\Admin\AppData\Local\Temp\9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Users\Admin\AppData\Local\Temp\9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe
  start
  2⤵
  PID:1540
- C:\Users\Admin\AppData\Local\Temp\9b3cac70360ea0dd9929443065bdfc6cff50daeca28c653204969a6a6815aabc.exe
  watch
  2⤵
  PID:424

memory/424-134-0x0000000000000000-mapping.dmp

Download
memory/424-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/424-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/424-142-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1540-135-0x0000000000000000-mapping.dmp

Download
memory/1540-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1540-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1540-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4328-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4328-133-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4328-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download