0f5ef799b28af6e03accf2fb5e496f3bbef924cac569f1979300dbc9dd718f67

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:12

Target

0f5ef799b28af6e03accf2fb5e496f3bbef924cac569f1979300dbc9dd718f67.exe
Size

523KB
MD5

2a10a457b62e58b05ef93ccc24138080
SHA1

5841cbfc026daa136e9f6fa467e54fd12da7b828
SHA256

0f5ef799b28af6e03accf2fb5e496f3bbef924cac569f1979300dbc9dd718f67
SHA512

ce8bbc5bace2b7caf8f28620b2a6c407f99c327d1f19e99cb1663c4f64d1ed77e7a90b63bb4af5a2b0a2aabe38d605869e45f45e01e1380db65dd46c8314968c
SSDEEP

6144:EonqgtwLlc2l/0hNmGU/XW4uLmz5oVHf6ZvYL0f0dxxxBfSIW/samc6ZsHRsGcI2:JqQDUubLmWJTDBfSV/samIReK7oLX

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

0f5ef799b28af6e03accf2fb5e496f3bbef924cac569f1979300dbc9dd718f67.exe

description	pid	process	target process
PID 1048 wrote to memory of 640	1048	0f5ef799b28af6e03accf2fb5e496f3bbef924cac569f1979300dbc9dd718f67.exe	0f5ef799b28af6e03accf2fb5e496f3bbef924cac569f1979300dbc9dd718f67.exe
PID 1048 wrote to memory of 640	1048	0f5ef799b28af6e03accf2fb5e496f3bbef924cac569f1979300dbc9dd718f67.exe	0f5ef799b28af6e03accf2fb5e496f3bbef924cac569f1979300dbc9dd718f67.exe
PID 1048 wrote to memory of 640	1048	0f5ef799b28af6e03accf2fb5e496f3bbef924cac569f1979300dbc9dd718f67.exe	0f5ef799b28af6e03accf2fb5e496f3bbef924cac569f1979300dbc9dd718f67.exe

C:\Users\Admin\AppData\Local\Temp\0f5ef799b28af6e03accf2fb5e496f3bbef924cac569f1979300dbc9dd718f67.exe
"C:\Users\Admin\AppData\Local\Temp\0f5ef799b28af6e03accf2fb5e496f3bbef924cac569f1979300dbc9dd718f67.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1048

C:\Users\Admin\AppData\Local\Temp\0f5ef799b28af6e03accf2fb5e496f3bbef924cac569f1979300dbc9dd718f67.exe
tear
2⤵
PID:640

memory/640-133-0x0000000000000000-mapping.dmp

Download
memory/640-135-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/640-136-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1048-132-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1048-134-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download