85aa84a70e5f408b0754bd44a86380e4022087737c27b463c0eb2a2c51853241

Analysis

max time kernel
112s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:11

Target

85aa84a70e5f408b0754bd44a86380e4022087737c27b463c0eb2a2c51853241.exe
Size

521KB
MD5

03501bf44567649a31ab55a9a6a2b6e5
SHA1

830e93466c006421f7a7a6218feffca6e2ef5827
SHA256

85aa84a70e5f408b0754bd44a86380e4022087737c27b463c0eb2a2c51853241
SHA512

bd7fb1a6ddfcd21c1bc356b0b36eb0dac68e8ca193891b3bde7a7bec6eda30c7f317d6aee0d73592027e5d4a5432da695dd674fc63bee47afe9048e0e1475477
SSDEEP

12288:CwW+ilPmIPM+RPfQQuTcMX9uOFLRB3dUEJQhGfRIDo+0jp6QkrnU:n6Qd+KcWpNUE/SY

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

85aa84a70e5f408b0754bd44a86380e4022087737c27b463c0eb2a2c51853241.exe

description	pid	process	target process
PID 4908 wrote to memory of 3988	4908	85aa84a70e5f408b0754bd44a86380e4022087737c27b463c0eb2a2c51853241.exe	85aa84a70e5f408b0754bd44a86380e4022087737c27b463c0eb2a2c51853241.exe
PID 4908 wrote to memory of 3988	4908	85aa84a70e5f408b0754bd44a86380e4022087737c27b463c0eb2a2c51853241.exe	85aa84a70e5f408b0754bd44a86380e4022087737c27b463c0eb2a2c51853241.exe
PID 4908 wrote to memory of 3988	4908	85aa84a70e5f408b0754bd44a86380e4022087737c27b463c0eb2a2c51853241.exe	85aa84a70e5f408b0754bd44a86380e4022087737c27b463c0eb2a2c51853241.exe
PID 4908 wrote to memory of 3672	4908	85aa84a70e5f408b0754bd44a86380e4022087737c27b463c0eb2a2c51853241.exe	85aa84a70e5f408b0754bd44a86380e4022087737c27b463c0eb2a2c51853241.exe
PID 4908 wrote to memory of 3672	4908	85aa84a70e5f408b0754bd44a86380e4022087737c27b463c0eb2a2c51853241.exe	85aa84a70e5f408b0754bd44a86380e4022087737c27b463c0eb2a2c51853241.exe
PID 4908 wrote to memory of 3672	4908	85aa84a70e5f408b0754bd44a86380e4022087737c27b463c0eb2a2c51853241.exe	85aa84a70e5f408b0754bd44a86380e4022087737c27b463c0eb2a2c51853241.exe

C:\Users\Admin\AppData\Local\Temp\85aa84a70e5f408b0754bd44a86380e4022087737c27b463c0eb2a2c51853241.exe
"C:\Users\Admin\AppData\Local\Temp\85aa84a70e5f408b0754bd44a86380e4022087737c27b463c0eb2a2c51853241.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4908

C:\Users\Admin\AppData\Local\Temp\85aa84a70e5f408b0754bd44a86380e4022087737c27b463c0eb2a2c51853241.exe
start
2⤵
PID:3988

C:\Users\Admin\AppData\Local\Temp\85aa84a70e5f408b0754bd44a86380e4022087737c27b463c0eb2a2c51853241.exe
watch
2⤵
PID:3672

memory/3672-133-0x0000000000000000-mapping.dmp

Download
memory/3672-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3672-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3988-134-0x0000000000000000-mapping.dmp

Download
memory/3988-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3988-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4908-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4908-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download