94ed83d4dafa690e3e8413b4d7fe596f9439b119c7a8f74d9a0e94b950ddbe72

Analysis

max time kernel
163s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:02

Target

94ed83d4dafa690e3e8413b4d7fe596f9439b119c7a8f74d9a0e94b950ddbe72.exe
Size

522KB
MD5

a972d2add096a6e129a12c95b3512df7
SHA1

163a1e0de0803d769f2b966f48b3c82035be5caf
SHA256

94ed83d4dafa690e3e8413b4d7fe596f9439b119c7a8f74d9a0e94b950ddbe72
SHA512

207941c78283e300822e19ac134aba5722b36c26d9a449951171701767e388c0023af6d41a16589e8e4caa05b9767eba3572933de7254cbc588805ba1a3f57b4
SSDEEP

6144:6FM/tcHJiEmbBVuxfFPSpMp7JNuQRlkybzRyPTdWk++mQy1CrxQqD9RSaSz+8O5f:AMbbEg2NuQraW0y18xQqpx8O5YZ

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

94ed83d4dafa690e3e8413b4d7fe596f9439b119c7a8f74d9a0e94b950ddbe72.exe

description	pid	process	target process
PID 3692 wrote to memory of 968	3692	94ed83d4dafa690e3e8413b4d7fe596f9439b119c7a8f74d9a0e94b950ddbe72.exe	94ed83d4dafa690e3e8413b4d7fe596f9439b119c7a8f74d9a0e94b950ddbe72.exe
PID 3692 wrote to memory of 968	3692	94ed83d4dafa690e3e8413b4d7fe596f9439b119c7a8f74d9a0e94b950ddbe72.exe	94ed83d4dafa690e3e8413b4d7fe596f9439b119c7a8f74d9a0e94b950ddbe72.exe
PID 3692 wrote to memory of 968	3692	94ed83d4dafa690e3e8413b4d7fe596f9439b119c7a8f74d9a0e94b950ddbe72.exe	94ed83d4dafa690e3e8413b4d7fe596f9439b119c7a8f74d9a0e94b950ddbe72.exe
PID 3692 wrote to memory of 4708	3692	94ed83d4dafa690e3e8413b4d7fe596f9439b119c7a8f74d9a0e94b950ddbe72.exe	94ed83d4dafa690e3e8413b4d7fe596f9439b119c7a8f74d9a0e94b950ddbe72.exe
PID 3692 wrote to memory of 4708	3692	94ed83d4dafa690e3e8413b4d7fe596f9439b119c7a8f74d9a0e94b950ddbe72.exe	94ed83d4dafa690e3e8413b4d7fe596f9439b119c7a8f74d9a0e94b950ddbe72.exe
PID 3692 wrote to memory of 4708	3692	94ed83d4dafa690e3e8413b4d7fe596f9439b119c7a8f74d9a0e94b950ddbe72.exe	94ed83d4dafa690e3e8413b4d7fe596f9439b119c7a8f74d9a0e94b950ddbe72.exe

C:\Users\Admin\AppData\Local\Temp\94ed83d4dafa690e3e8413b4d7fe596f9439b119c7a8f74d9a0e94b950ddbe72.exe
"C:\Users\Admin\AppData\Local\Temp\94ed83d4dafa690e3e8413b4d7fe596f9439b119c7a8f74d9a0e94b950ddbe72.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3692

C:\Users\Admin\AppData\Local\Temp\94ed83d4dafa690e3e8413b4d7fe596f9439b119c7a8f74d9a0e94b950ddbe72.exe
start
2⤵
PID:968

C:\Users\Admin\AppData\Local\Temp\94ed83d4dafa690e3e8413b4d7fe596f9439b119c7a8f74d9a0e94b950ddbe72.exe
watch
2⤵
PID:4708

memory/968-134-0x0000000000000000-mapping.dmp

Download
memory/968-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/968-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/968-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3692-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3692-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4708-133-0x0000000000000000-mapping.dmp

Download
memory/4708-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4708-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4708-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download