fe6e5db764ad819eecb8657f4d8a9a254670dfa063371cf5c678af9b0d71aa0e

Analysis

max time kernel
152s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:47

Target

fe6e5db764ad819eecb8657f4d8a9a254670dfa063371cf5c678af9b0d71aa0e.exe
Size

522KB
MD5

0fe75df83b2efc78c08490d688ffdd02
SHA1

b579ad6692546bd8fc501683b0651c91a5c8986b
SHA256

fe6e5db764ad819eecb8657f4d8a9a254670dfa063371cf5c678af9b0d71aa0e
SHA512

2bf3e678b3ce80ecc48c115485737cebc529419d42de256d72567d3aa89108b73b46baa176fa210a20cf190eb5d96c0a55396e82278ef56f59d8c28d35e5e512
SSDEEP

12288:c64yvV48ncWPdSsgjPUNM3wYYlLPt5oKnWq3eby:cEvV48nJB7lLPt5/W7y

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

fe6e5db764ad819eecb8657f4d8a9a254670dfa063371cf5c678af9b0d71aa0e.exe

description	pid	process	target process
PID 2688 wrote to memory of 2172	2688	fe6e5db764ad819eecb8657f4d8a9a254670dfa063371cf5c678af9b0d71aa0e.exe	fe6e5db764ad819eecb8657f4d8a9a254670dfa063371cf5c678af9b0d71aa0e.exe
PID 2688 wrote to memory of 2172	2688	fe6e5db764ad819eecb8657f4d8a9a254670dfa063371cf5c678af9b0d71aa0e.exe	fe6e5db764ad819eecb8657f4d8a9a254670dfa063371cf5c678af9b0d71aa0e.exe
PID 2688 wrote to memory of 2172	2688	fe6e5db764ad819eecb8657f4d8a9a254670dfa063371cf5c678af9b0d71aa0e.exe	fe6e5db764ad819eecb8657f4d8a9a254670dfa063371cf5c678af9b0d71aa0e.exe
PID 2688 wrote to memory of 4512	2688	fe6e5db764ad819eecb8657f4d8a9a254670dfa063371cf5c678af9b0d71aa0e.exe	fe6e5db764ad819eecb8657f4d8a9a254670dfa063371cf5c678af9b0d71aa0e.exe
PID 2688 wrote to memory of 4512	2688	fe6e5db764ad819eecb8657f4d8a9a254670dfa063371cf5c678af9b0d71aa0e.exe	fe6e5db764ad819eecb8657f4d8a9a254670dfa063371cf5c678af9b0d71aa0e.exe
PID 2688 wrote to memory of 4512	2688	fe6e5db764ad819eecb8657f4d8a9a254670dfa063371cf5c678af9b0d71aa0e.exe	fe6e5db764ad819eecb8657f4d8a9a254670dfa063371cf5c678af9b0d71aa0e.exe

C:\Users\Admin\AppData\Local\Temp\fe6e5db764ad819eecb8657f4d8a9a254670dfa063371cf5c678af9b0d71aa0e.exe
"C:\Users\Admin\AppData\Local\Temp\fe6e5db764ad819eecb8657f4d8a9a254670dfa063371cf5c678af9b0d71aa0e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2688

C:\Users\Admin\AppData\Local\Temp\fe6e5db764ad819eecb8657f4d8a9a254670dfa063371cf5c678af9b0d71aa0e.exe
watch
2⤵
PID:4512

C:\Users\Admin\AppData\Local\Temp\fe6e5db764ad819eecb8657f4d8a9a254670dfa063371cf5c678af9b0d71aa0e.exe
start
2⤵
PID:2172

memory/2172-133-0x0000000000000000-mapping.dmp

Download
memory/2172-136-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2172-137-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2688-134-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4512-132-0x0000000000000000-mapping.dmp

Download
memory/4512-135-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4512-138-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4512-139-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download