9ed2c4fd9556c37acbdbfbce8e6f7b6e45eb4533414bee32b46a424a6096022b

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:00

Target

9ed2c4fd9556c37acbdbfbce8e6f7b6e45eb4533414bee32b46a424a6096022b.exe
Size

518KB
MD5

bf952f2a382702bcf9f4265f7c6bf8fa
SHA1

6c37f27bcb71a14e56c6686f39f1cc96ffbe29e0
SHA256

9ed2c4fd9556c37acbdbfbce8e6f7b6e45eb4533414bee32b46a424a6096022b
SHA512

0bbb2e94074a74e86f53a621c317a6398215b8fc92ea49a7e3ef43fba52e85b4cc616fad3a03d3b829f0f51a7f15825ecbe989c8d7a8d6eacab96d4558d92f63
SSDEEP

12288:4IFlstRF+4izIQzwYYlLPt5oKnWq3OCb:zIRF+2RlLPt5/We

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

9ed2c4fd9556c37acbdbfbce8e6f7b6e45eb4533414bee32b46a424a6096022b.exe

description	pid	process	target process
PID 632 wrote to memory of 2160	632	9ed2c4fd9556c37acbdbfbce8e6f7b6e45eb4533414bee32b46a424a6096022b.exe	9ed2c4fd9556c37acbdbfbce8e6f7b6e45eb4533414bee32b46a424a6096022b.exe
PID 632 wrote to memory of 2160	632	9ed2c4fd9556c37acbdbfbce8e6f7b6e45eb4533414bee32b46a424a6096022b.exe	9ed2c4fd9556c37acbdbfbce8e6f7b6e45eb4533414bee32b46a424a6096022b.exe
PID 632 wrote to memory of 2160	632	9ed2c4fd9556c37acbdbfbce8e6f7b6e45eb4533414bee32b46a424a6096022b.exe	9ed2c4fd9556c37acbdbfbce8e6f7b6e45eb4533414bee32b46a424a6096022b.exe
PID 632 wrote to memory of 820	632	9ed2c4fd9556c37acbdbfbce8e6f7b6e45eb4533414bee32b46a424a6096022b.exe	9ed2c4fd9556c37acbdbfbce8e6f7b6e45eb4533414bee32b46a424a6096022b.exe
PID 632 wrote to memory of 820	632	9ed2c4fd9556c37acbdbfbce8e6f7b6e45eb4533414bee32b46a424a6096022b.exe	9ed2c4fd9556c37acbdbfbce8e6f7b6e45eb4533414bee32b46a424a6096022b.exe
PID 632 wrote to memory of 820	632	9ed2c4fd9556c37acbdbfbce8e6f7b6e45eb4533414bee32b46a424a6096022b.exe	9ed2c4fd9556c37acbdbfbce8e6f7b6e45eb4533414bee32b46a424a6096022b.exe

C:\Users\Admin\AppData\Local\Temp\9ed2c4fd9556c37acbdbfbce8e6f7b6e45eb4533414bee32b46a424a6096022b.exe
"C:\Users\Admin\AppData\Local\Temp\9ed2c4fd9556c37acbdbfbce8e6f7b6e45eb4533414bee32b46a424a6096022b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:632

C:\Users\Admin\AppData\Local\Temp\9ed2c4fd9556c37acbdbfbce8e6f7b6e45eb4533414bee32b46a424a6096022b.exe
start
2⤵
PID:2160

C:\Users\Admin\AppData\Local\Temp\9ed2c4fd9556c37acbdbfbce8e6f7b6e45eb4533414bee32b46a424a6096022b.exe
watch
2⤵
PID:820

memory/632-134-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/820-132-0x0000000000000000-mapping.dmp

Download
memory/820-135-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/820-137-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/820-140-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2160-133-0x0000000000000000-mapping.dmp

Download
memory/2160-136-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2160-138-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2160-139-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download