a76e4229736aa0636141cce8862083428375461f21386e7996efc2251a488693

Analysis

max time kernel
275s
max time network
359s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:00

Target

a76e4229736aa0636141cce8862083428375461f21386e7996efc2251a488693.exe
Size

518KB
MD5

40c965b1f5dfe9f915fa5ce628b14cf0
SHA1

26320da6cfd08272291bd94f1c5048344ba3f05e
SHA256

a76e4229736aa0636141cce8862083428375461f21386e7996efc2251a488693
SHA512

30e2b9c07ff804c6dc2061fce14a018113d19e6144a9749c0f085f598b32c9e00f95df08f3061b7e752a40eeb8771ff1e8dd7e8712dc20b38b0ad97fedd04c80
SSDEEP

12288:G9A36kFUcUHSWuHEXwYYlLPt5oKnWq35b:Y1FcUydkclLPt5/WA

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

a76e4229736aa0636141cce8862083428375461f21386e7996efc2251a488693.exe

description	pid	process	target process
PID 1772 wrote to memory of 1604	1772	a76e4229736aa0636141cce8862083428375461f21386e7996efc2251a488693.exe	a76e4229736aa0636141cce8862083428375461f21386e7996efc2251a488693.exe
PID 1772 wrote to memory of 1604	1772	a76e4229736aa0636141cce8862083428375461f21386e7996efc2251a488693.exe	a76e4229736aa0636141cce8862083428375461f21386e7996efc2251a488693.exe
PID 1772 wrote to memory of 1604	1772	a76e4229736aa0636141cce8862083428375461f21386e7996efc2251a488693.exe	a76e4229736aa0636141cce8862083428375461f21386e7996efc2251a488693.exe
PID 1772 wrote to memory of 4520	1772	a76e4229736aa0636141cce8862083428375461f21386e7996efc2251a488693.exe	a76e4229736aa0636141cce8862083428375461f21386e7996efc2251a488693.exe
PID 1772 wrote to memory of 4520	1772	a76e4229736aa0636141cce8862083428375461f21386e7996efc2251a488693.exe	a76e4229736aa0636141cce8862083428375461f21386e7996efc2251a488693.exe
PID 1772 wrote to memory of 4520	1772	a76e4229736aa0636141cce8862083428375461f21386e7996efc2251a488693.exe	a76e4229736aa0636141cce8862083428375461f21386e7996efc2251a488693.exe

C:\Users\Admin\AppData\Local\Temp\a76e4229736aa0636141cce8862083428375461f21386e7996efc2251a488693.exe
"C:\Users\Admin\AppData\Local\Temp\a76e4229736aa0636141cce8862083428375461f21386e7996efc2251a488693.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1772

C:\Users\Admin\AppData\Local\Temp\a76e4229736aa0636141cce8862083428375461f21386e7996efc2251a488693.exe
start
2⤵
PID:1604

C:\Users\Admin\AppData\Local\Temp\a76e4229736aa0636141cce8862083428375461f21386e7996efc2251a488693.exe
watch
2⤵
PID:4520

memory/1604-134-0x0000000000000000-mapping.dmp

Download
memory/1604-137-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1604-139-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1772-132-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1772-135-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4520-133-0x0000000000000000-mapping.dmp

Download
memory/4520-136-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4520-138-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download