01c20a5ef073d26d43fb6582af6e96780c9b934e9a17e4878e82f12e69bbe671

Analysis

max time kernel
80s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:12

Target

01c20a5ef073d26d43fb6582af6e96780c9b934e9a17e4878e82f12e69bbe671.exe
Size

524KB
MD5

6bf2a4e4f805a2e3a12d83aaecfb3ce2
SHA1

9291ba680d4a52b93470bbec8ddd273e8a30da98
SHA256

01c20a5ef073d26d43fb6582af6e96780c9b934e9a17e4878e82f12e69bbe671
SHA512

0d72863f759b3f2db7cdd8c2eff4141564c78341c50f590da700bb54b167601bf6a7092b98cc74d173d17be968b487813b0884203d55f697356a199cc553e4fc
SSDEEP

12288:qUxPmhSvkq1ra1HPAZVzvBVKXCuapzDBG:7mhbera1vAZVzvSXCXD

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

01c20a5ef073d26d43fb6582af6e96780c9b934e9a17e4878e82f12e69bbe671.exe

description	pid	process	target process
PID 1688 wrote to memory of 4596	1688	01c20a5ef073d26d43fb6582af6e96780c9b934e9a17e4878e82f12e69bbe671.exe	01c20a5ef073d26d43fb6582af6e96780c9b934e9a17e4878e82f12e69bbe671.exe
PID 1688 wrote to memory of 4596	1688	01c20a5ef073d26d43fb6582af6e96780c9b934e9a17e4878e82f12e69bbe671.exe	01c20a5ef073d26d43fb6582af6e96780c9b934e9a17e4878e82f12e69bbe671.exe
PID 1688 wrote to memory of 4596	1688	01c20a5ef073d26d43fb6582af6e96780c9b934e9a17e4878e82f12e69bbe671.exe	01c20a5ef073d26d43fb6582af6e96780c9b934e9a17e4878e82f12e69bbe671.exe

C:\Users\Admin\AppData\Local\Temp\01c20a5ef073d26d43fb6582af6e96780c9b934e9a17e4878e82f12e69bbe671.exe
"C:\Users\Admin\AppData\Local\Temp\01c20a5ef073d26d43fb6582af6e96780c9b934e9a17e4878e82f12e69bbe671.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1688

C:\Users\Admin\AppData\Local\Temp\01c20a5ef073d26d43fb6582af6e96780c9b934e9a17e4878e82f12e69bbe671.exe
tear
2⤵
PID:4596

memory/1688-132-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1688-134-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/4596-133-0x0000000000000000-mapping.dmp

Download
memory/4596-135-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/4596-136-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/4596-137-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/4596-138-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download