e1bf1d6a3ba9336da53b1292c53c0cd8c5e940c79b3624b42b9f6448e85e2ea5

Analysis

max time kernel
172s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:53

Target

e1bf1d6a3ba9336da53b1292c53c0cd8c5e940c79b3624b42b9f6448e85e2ea5.exe
Size

522KB
MD5

1fb8e4f40265cbd4a07bf5b7024bf1b1
SHA1

d93a5784a9c4a926b31a204a5e2fd68d37814623
SHA256

e1bf1d6a3ba9336da53b1292c53c0cd8c5e940c79b3624b42b9f6448e85e2ea5
SHA512

a2af4efaf45f8da2082ab8f6761440ba234b1946a6292681833b6bde0f7882dc0e5c582cbca9d11f5d3a2259d117b88fc1d4e04322232e8365e03367a1bbbd67
SSDEEP

6144:wpaakvpEfXzb2fd0/SbFv4AKJIDpiEkToxdzR9hDRXbpXuJAmQy1CrxQqD9RSaS6:4fveSSOUpycxZbNuJcy18xQqpx8O52

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

e1bf1d6a3ba9336da53b1292c53c0cd8c5e940c79b3624b42b9f6448e85e2ea5.exe

description	pid	process	target process
PID 2040 wrote to memory of 2764	2040	e1bf1d6a3ba9336da53b1292c53c0cd8c5e940c79b3624b42b9f6448e85e2ea5.exe	e1bf1d6a3ba9336da53b1292c53c0cd8c5e940c79b3624b42b9f6448e85e2ea5.exe
PID 2040 wrote to memory of 2764	2040	e1bf1d6a3ba9336da53b1292c53c0cd8c5e940c79b3624b42b9f6448e85e2ea5.exe	e1bf1d6a3ba9336da53b1292c53c0cd8c5e940c79b3624b42b9f6448e85e2ea5.exe
PID 2040 wrote to memory of 2764	2040	e1bf1d6a3ba9336da53b1292c53c0cd8c5e940c79b3624b42b9f6448e85e2ea5.exe	e1bf1d6a3ba9336da53b1292c53c0cd8c5e940c79b3624b42b9f6448e85e2ea5.exe
PID 2040 wrote to memory of 2020	2040	e1bf1d6a3ba9336da53b1292c53c0cd8c5e940c79b3624b42b9f6448e85e2ea5.exe	e1bf1d6a3ba9336da53b1292c53c0cd8c5e940c79b3624b42b9f6448e85e2ea5.exe
PID 2040 wrote to memory of 2020	2040	e1bf1d6a3ba9336da53b1292c53c0cd8c5e940c79b3624b42b9f6448e85e2ea5.exe	e1bf1d6a3ba9336da53b1292c53c0cd8c5e940c79b3624b42b9f6448e85e2ea5.exe
PID 2040 wrote to memory of 2020	2040	e1bf1d6a3ba9336da53b1292c53c0cd8c5e940c79b3624b42b9f6448e85e2ea5.exe	e1bf1d6a3ba9336da53b1292c53c0cd8c5e940c79b3624b42b9f6448e85e2ea5.exe

C:\Users\Admin\AppData\Local\Temp\e1bf1d6a3ba9336da53b1292c53c0cd8c5e940c79b3624b42b9f6448e85e2ea5.exe
"C:\Users\Admin\AppData\Local\Temp\e1bf1d6a3ba9336da53b1292c53c0cd8c5e940c79b3624b42b9f6448e85e2ea5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Local\Temp\e1bf1d6a3ba9336da53b1292c53c0cd8c5e940c79b3624b42b9f6448e85e2ea5.exe
  start
  2⤵
  PID:2764
- C:\Users\Admin\AppData\Local\Temp\e1bf1d6a3ba9336da53b1292c53c0cd8c5e940c79b3624b42b9f6448e85e2ea5.exe
  watch
  2⤵
  PID:2020

memory/2020-133-0x0000000000000000-mapping.dmp

Download
memory/2020-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2020-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2020-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2040-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2040-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2764-134-0x0000000000000000-mapping.dmp

Download
memory/2764-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2764-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2764-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download