de622431ddd045b67af3fdf356a550cd71af5995d390fe0d29ab0168d224eac3

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:54

Target

de622431ddd045b67af3fdf356a550cd71af5995d390fe0d29ab0168d224eac3.exe
Size

524KB
MD5

a87672b9ace0baeaeaa37d246235a27c
SHA1

5882098c239d8f30c82890c3fc28a9c9d861b253
SHA256

de622431ddd045b67af3fdf356a550cd71af5995d390fe0d29ab0168d224eac3
SHA512

4ffbbf761dbfa52b7b9bb5190f55818bf8e6e682ffef25c65468912f39910ff92d86969c835d771f80c8dc8b3ba4bfed618ea9db45c59ab2534b6c0462d3fb2b
SSDEEP

12288:GaYCUVvoCW1vWOrAKVzvBVKXCuapzDBG:D8BkOOrAKVzvSXCXD

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

de622431ddd045b67af3fdf356a550cd71af5995d390fe0d29ab0168d224eac3.exe

description	pid	process	target process
PID 4572 wrote to memory of 5068	4572	de622431ddd045b67af3fdf356a550cd71af5995d390fe0d29ab0168d224eac3.exe	de622431ddd045b67af3fdf356a550cd71af5995d390fe0d29ab0168d224eac3.exe
PID 4572 wrote to memory of 5068	4572	de622431ddd045b67af3fdf356a550cd71af5995d390fe0d29ab0168d224eac3.exe	de622431ddd045b67af3fdf356a550cd71af5995d390fe0d29ab0168d224eac3.exe
PID 4572 wrote to memory of 5068	4572	de622431ddd045b67af3fdf356a550cd71af5995d390fe0d29ab0168d224eac3.exe	de622431ddd045b67af3fdf356a550cd71af5995d390fe0d29ab0168d224eac3.exe

C:\Users\Admin\AppData\Local\Temp\de622431ddd045b67af3fdf356a550cd71af5995d390fe0d29ab0168d224eac3.exe
"C:\Users\Admin\AppData\Local\Temp\de622431ddd045b67af3fdf356a550cd71af5995d390fe0d29ab0168d224eac3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4572

C:\Users\Admin\AppData\Local\Temp\de622431ddd045b67af3fdf356a550cd71af5995d390fe0d29ab0168d224eac3.exe
tear
2⤵
PID:5068

memory/4572-132-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/4572-133-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/4572-135-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/5068-134-0x0000000000000000-mapping.dmp

Download
memory/5068-136-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/5068-137-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/5068-138-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download