a79ccdabb7d360e24159fb3d8bb628a9ff1eb56b977a19be2c46e31936f098d9

Analysis

max time kernel
90s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:00

Target

a79ccdabb7d360e24159fb3d8bb628a9ff1eb56b977a19be2c46e31936f098d9.exe
Size

526KB
MD5

ba68419f7b263bbb344adc0afb36e0a7
SHA1

83979c72814e5bca28c5c465b95006c87998277f
SHA256

a79ccdabb7d360e24159fb3d8bb628a9ff1eb56b977a19be2c46e31936f098d9
SHA512

ef5317c83372dc82aac4f6e9ed07aed8d687e2e1dc7d1ff71a10a05df96382b3d0f271e23863d4f7273de197584fcd2c74348150708a7cb55853d6d94db833a0
SSDEEP

12288:g3JdW+USFzXQIFikbEjwjy18xQqpx8O5r1:gTPFtFHbEj8atqpx8m

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

a79ccdabb7d360e24159fb3d8bb628a9ff1eb56b977a19be2c46e31936f098d9.exe

description	pid	process	target process
PID 1516 wrote to memory of 5072	1516	a79ccdabb7d360e24159fb3d8bb628a9ff1eb56b977a19be2c46e31936f098d9.exe	a79ccdabb7d360e24159fb3d8bb628a9ff1eb56b977a19be2c46e31936f098d9.exe
PID 1516 wrote to memory of 5072	1516	a79ccdabb7d360e24159fb3d8bb628a9ff1eb56b977a19be2c46e31936f098d9.exe	a79ccdabb7d360e24159fb3d8bb628a9ff1eb56b977a19be2c46e31936f098d9.exe
PID 1516 wrote to memory of 5072	1516	a79ccdabb7d360e24159fb3d8bb628a9ff1eb56b977a19be2c46e31936f098d9.exe	a79ccdabb7d360e24159fb3d8bb628a9ff1eb56b977a19be2c46e31936f098d9.exe
PID 1516 wrote to memory of 2296	1516	a79ccdabb7d360e24159fb3d8bb628a9ff1eb56b977a19be2c46e31936f098d9.exe	a79ccdabb7d360e24159fb3d8bb628a9ff1eb56b977a19be2c46e31936f098d9.exe
PID 1516 wrote to memory of 2296	1516	a79ccdabb7d360e24159fb3d8bb628a9ff1eb56b977a19be2c46e31936f098d9.exe	a79ccdabb7d360e24159fb3d8bb628a9ff1eb56b977a19be2c46e31936f098d9.exe
PID 1516 wrote to memory of 2296	1516	a79ccdabb7d360e24159fb3d8bb628a9ff1eb56b977a19be2c46e31936f098d9.exe	a79ccdabb7d360e24159fb3d8bb628a9ff1eb56b977a19be2c46e31936f098d9.exe

C:\Users\Admin\AppData\Local\Temp\a79ccdabb7d360e24159fb3d8bb628a9ff1eb56b977a19be2c46e31936f098d9.exe
"C:\Users\Admin\AppData\Local\Temp\a79ccdabb7d360e24159fb3d8bb628a9ff1eb56b977a19be2c46e31936f098d9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1516

C:\Users\Admin\AppData\Local\Temp\a79ccdabb7d360e24159fb3d8bb628a9ff1eb56b977a19be2c46e31936f098d9.exe
start
2⤵
PID:5072

C:\Users\Admin\AppData\Local\Temp\a79ccdabb7d360e24159fb3d8bb628a9ff1eb56b977a19be2c46e31936f098d9.exe
watch
2⤵
PID:2296

memory/1516-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1516-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2296-133-0x0000000000000000-mapping.dmp

Download
memory/2296-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2296-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2296-142-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/5072-134-0x0000000000000000-mapping.dmp

Download
memory/5072-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/5072-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/5072-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/5072-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download