e334194fe32ac5c9fac628c7242e2055d13f2f20d192db9dc5be331cde1ec988

Analysis

max time kernel
144s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:52

Target

e334194fe32ac5c9fac628c7242e2055d13f2f20d192db9dc5be331cde1ec988.exe
Size

524KB
MD5

9ccf15371d64e0d8579a191d2b3a6a72
SHA1

b0869ac9b33f2921b957f4cfeda362326bdefe32
SHA256

e334194fe32ac5c9fac628c7242e2055d13f2f20d192db9dc5be331cde1ec988
SHA512

3e250aacd7bfb5feaf31af3b36a8469e7a46b09e9f37d64b3dca9f155fe12694d710d1942de090c5b8c00995f9ad154fbe3d43aef93fae2b1759df2d8186dd0c
SSDEEP

12288:zTtH/RPMNY69Nk8Vo59tWv4bON/uL63PTb/g0OJp/Dbdg:/tyK69NB2nAOy/uE/QfLZg

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

e334194fe32ac5c9fac628c7242e2055d13f2f20d192db9dc5be331cde1ec988.exe

description	pid	process	target process
PID 4808 wrote to memory of 916	4808	e334194fe32ac5c9fac628c7242e2055d13f2f20d192db9dc5be331cde1ec988.exe	e334194fe32ac5c9fac628c7242e2055d13f2f20d192db9dc5be331cde1ec988.exe
PID 4808 wrote to memory of 916	4808	e334194fe32ac5c9fac628c7242e2055d13f2f20d192db9dc5be331cde1ec988.exe	e334194fe32ac5c9fac628c7242e2055d13f2f20d192db9dc5be331cde1ec988.exe
PID 4808 wrote to memory of 916	4808	e334194fe32ac5c9fac628c7242e2055d13f2f20d192db9dc5be331cde1ec988.exe	e334194fe32ac5c9fac628c7242e2055d13f2f20d192db9dc5be331cde1ec988.exe
PID 4808 wrote to memory of 872	4808	e334194fe32ac5c9fac628c7242e2055d13f2f20d192db9dc5be331cde1ec988.exe	e334194fe32ac5c9fac628c7242e2055d13f2f20d192db9dc5be331cde1ec988.exe
PID 4808 wrote to memory of 872	4808	e334194fe32ac5c9fac628c7242e2055d13f2f20d192db9dc5be331cde1ec988.exe	e334194fe32ac5c9fac628c7242e2055d13f2f20d192db9dc5be331cde1ec988.exe
PID 4808 wrote to memory of 872	4808	e334194fe32ac5c9fac628c7242e2055d13f2f20d192db9dc5be331cde1ec988.exe	e334194fe32ac5c9fac628c7242e2055d13f2f20d192db9dc5be331cde1ec988.exe

C:\Users\Admin\AppData\Local\Temp\e334194fe32ac5c9fac628c7242e2055d13f2f20d192db9dc5be331cde1ec988.exe
"C:\Users\Admin\AppData\Local\Temp\e334194fe32ac5c9fac628c7242e2055d13f2f20d192db9dc5be331cde1ec988.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4808

C:\Users\Admin\AppData\Local\Temp\e334194fe32ac5c9fac628c7242e2055d13f2f20d192db9dc5be331cde1ec988.exe
start
2⤵
PID:916

C:\Users\Admin\AppData\Local\Temp\e334194fe32ac5c9fac628c7242e2055d13f2f20d192db9dc5be331cde1ec988.exe
watch
2⤵
PID:872

memory/872-132-0x0000000000000000-mapping.dmp

Download
memory/872-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/872-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/872-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/916-133-0x0000000000000000-mapping.dmp

Download
memory/916-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/916-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/916-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4808-134-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download