e779a71aedaa5cef56f89faad2407966a9c25d92654276d32177a59afd2290f8

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:50

Target

e779a71aedaa5cef56f89faad2407966a9c25d92654276d32177a59afd2290f8.exe
Size

522KB
MD5

1dfec1d6ff3ad951ae74737d7fe7ec85
SHA1

07221e7a78f1af28025c06aff655b8c4530e6c8e
SHA256

e779a71aedaa5cef56f89faad2407966a9c25d92654276d32177a59afd2290f8
SHA512

6c8dd98af50fe3aa15079534d2625c3e25909c9ba50d9e3cf058b5f021f0a38dd9b361e8fd17ce7099e8bcdd79406e78dbf6dc7db988d6009ffadd747780259c
SSDEEP

12288:WX21kEYR+VsdKDZQMiTfCT9cy18xQqpx8O5G:O21Da+dDZPRiatqpx8

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

e779a71aedaa5cef56f89faad2407966a9c25d92654276d32177a59afd2290f8.exe

description	pid	process	target process
PID 2768 wrote to memory of 4896	2768	e779a71aedaa5cef56f89faad2407966a9c25d92654276d32177a59afd2290f8.exe	e779a71aedaa5cef56f89faad2407966a9c25d92654276d32177a59afd2290f8.exe
PID 2768 wrote to memory of 4896	2768	e779a71aedaa5cef56f89faad2407966a9c25d92654276d32177a59afd2290f8.exe	e779a71aedaa5cef56f89faad2407966a9c25d92654276d32177a59afd2290f8.exe
PID 2768 wrote to memory of 4896	2768	e779a71aedaa5cef56f89faad2407966a9c25d92654276d32177a59afd2290f8.exe	e779a71aedaa5cef56f89faad2407966a9c25d92654276d32177a59afd2290f8.exe
PID 2768 wrote to memory of 2812	2768	e779a71aedaa5cef56f89faad2407966a9c25d92654276d32177a59afd2290f8.exe	e779a71aedaa5cef56f89faad2407966a9c25d92654276d32177a59afd2290f8.exe
PID 2768 wrote to memory of 2812	2768	e779a71aedaa5cef56f89faad2407966a9c25d92654276d32177a59afd2290f8.exe	e779a71aedaa5cef56f89faad2407966a9c25d92654276d32177a59afd2290f8.exe
PID 2768 wrote to memory of 2812	2768	e779a71aedaa5cef56f89faad2407966a9c25d92654276d32177a59afd2290f8.exe	e779a71aedaa5cef56f89faad2407966a9c25d92654276d32177a59afd2290f8.exe

C:\Users\Admin\AppData\Local\Temp\e779a71aedaa5cef56f89faad2407966a9c25d92654276d32177a59afd2290f8.exe
"C:\Users\Admin\AppData\Local\Temp\e779a71aedaa5cef56f89faad2407966a9c25d92654276d32177a59afd2290f8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2768

C:\Users\Admin\AppData\Local\Temp\e779a71aedaa5cef56f89faad2407966a9c25d92654276d32177a59afd2290f8.exe
start
2⤵
PID:4896

C:\Users\Admin\AppData\Local\Temp\e779a71aedaa5cef56f89faad2407966a9c25d92654276d32177a59afd2290f8.exe
watch
2⤵
PID:2812

memory/2768-133-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2768-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2768-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2812-142-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2812-134-0x0000000000000000-mapping.dmp

Download
memory/2812-144-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2812-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2812-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4896-135-0x0000000000000000-mapping.dmp

Download
memory/4896-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4896-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4896-143-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4896-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download