9a85c874378a735b35d585df3f202132112eb09bd3cf0e113f4b9dc5a6154318

Analysis

max time kernel
145s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:01

Target

9a85c874378a735b35d585df3f202132112eb09bd3cf0e113f4b9dc5a6154318.exe
Size

522KB
MD5

6ea6957088eedaa5b19a2069fefb8f08
SHA1

f9e2e1ab4a0b3b8ba138ffb75b9b25b68de6393d
SHA256

9a85c874378a735b35d585df3f202132112eb09bd3cf0e113f4b9dc5a6154318
SHA512

31e310effd2e899751e3e72e4942d4ba4019cc3a86419a1d74b67b6946f7151afaad37a35f31ed034dbf4ca8d43ccd4cdd9999a2e49564ce7d791c29767ca274
SSDEEP

6144:sciuO9nPutiYqgu76q7z3l1v+3faEs4n8ZYvn5mQy1CrxQqD9RSaSz+8O5hBhZe:3iuOVYql7LlYyEsPIy18xQqpx8O5hB

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

9a85c874378a735b35d585df3f202132112eb09bd3cf0e113f4b9dc5a6154318.exe

description	pid	process	target process
PID 4840 wrote to memory of 3104	4840	9a85c874378a735b35d585df3f202132112eb09bd3cf0e113f4b9dc5a6154318.exe	9a85c874378a735b35d585df3f202132112eb09bd3cf0e113f4b9dc5a6154318.exe
PID 4840 wrote to memory of 3104	4840	9a85c874378a735b35d585df3f202132112eb09bd3cf0e113f4b9dc5a6154318.exe	9a85c874378a735b35d585df3f202132112eb09bd3cf0e113f4b9dc5a6154318.exe
PID 4840 wrote to memory of 3104	4840	9a85c874378a735b35d585df3f202132112eb09bd3cf0e113f4b9dc5a6154318.exe	9a85c874378a735b35d585df3f202132112eb09bd3cf0e113f4b9dc5a6154318.exe
PID 4840 wrote to memory of 1224	4840	9a85c874378a735b35d585df3f202132112eb09bd3cf0e113f4b9dc5a6154318.exe	9a85c874378a735b35d585df3f202132112eb09bd3cf0e113f4b9dc5a6154318.exe
PID 4840 wrote to memory of 1224	4840	9a85c874378a735b35d585df3f202132112eb09bd3cf0e113f4b9dc5a6154318.exe	9a85c874378a735b35d585df3f202132112eb09bd3cf0e113f4b9dc5a6154318.exe
PID 4840 wrote to memory of 1224	4840	9a85c874378a735b35d585df3f202132112eb09bd3cf0e113f4b9dc5a6154318.exe	9a85c874378a735b35d585df3f202132112eb09bd3cf0e113f4b9dc5a6154318.exe

C:\Users\Admin\AppData\Local\Temp\9a85c874378a735b35d585df3f202132112eb09bd3cf0e113f4b9dc5a6154318.exe
"C:\Users\Admin\AppData\Local\Temp\9a85c874378a735b35d585df3f202132112eb09bd3cf0e113f4b9dc5a6154318.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4840

C:\Users\Admin\AppData\Local\Temp\9a85c874378a735b35d585df3f202132112eb09bd3cf0e113f4b9dc5a6154318.exe
start
2⤵
PID:3104

C:\Users\Admin\AppData\Local\Temp\9a85c874378a735b35d585df3f202132112eb09bd3cf0e113f4b9dc5a6154318.exe
watch
2⤵
PID:1224

memory/1224-133-0x0000000000000000-mapping.dmp

Download
memory/1224-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1224-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1224-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3104-134-0x0000000000000000-mapping.dmp

Download
memory/3104-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3104-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3104-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4840-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4840-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download