d8093b92969f71e8f5fec5537e0aab1bc06ce493f314f5f0afaf692a5c76869d

Analysis

max time kernel
148s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:58

Target

d8093b92969f71e8f5fec5537e0aab1bc06ce493f314f5f0afaf692a5c76869d.exe
Size

522KB
MD5

3c0c053a634b6ad3cd98995fe0f8a260
SHA1

b4db26ff38c99f5a4dd326871b04f8c27955416c
SHA256

d8093b92969f71e8f5fec5537e0aab1bc06ce493f314f5f0afaf692a5c76869d
SHA512

7c9c5cb10d55c1a55343a502ff35cbf020dea195dea275cd8c9e27b576dc63165d2a436e92c68c4e3c739440aadfed459c8a32c75d13a4a425dea9ae4a124947
SSDEEP

6144:DxtJ1jncctIBdVusAXQjG8vsNCDX6Wi55o5spUw27iUbITwBH/kvSUFsvWx3LbpI:D19wduFQxVDXi55o5twRpTw5iivWxBZ

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

d8093b92969f71e8f5fec5537e0aab1bc06ce493f314f5f0afaf692a5c76869d.exe

description	pid	process	target process
PID 4668 wrote to memory of 4004	4668	d8093b92969f71e8f5fec5537e0aab1bc06ce493f314f5f0afaf692a5c76869d.exe	d8093b92969f71e8f5fec5537e0aab1bc06ce493f314f5f0afaf692a5c76869d.exe
PID 4668 wrote to memory of 4004	4668	d8093b92969f71e8f5fec5537e0aab1bc06ce493f314f5f0afaf692a5c76869d.exe	d8093b92969f71e8f5fec5537e0aab1bc06ce493f314f5f0afaf692a5c76869d.exe
PID 4668 wrote to memory of 4004	4668	d8093b92969f71e8f5fec5537e0aab1bc06ce493f314f5f0afaf692a5c76869d.exe	d8093b92969f71e8f5fec5537e0aab1bc06ce493f314f5f0afaf692a5c76869d.exe
PID 4668 wrote to memory of 620	4668	d8093b92969f71e8f5fec5537e0aab1bc06ce493f314f5f0afaf692a5c76869d.exe	d8093b92969f71e8f5fec5537e0aab1bc06ce493f314f5f0afaf692a5c76869d.exe
PID 4668 wrote to memory of 620	4668	d8093b92969f71e8f5fec5537e0aab1bc06ce493f314f5f0afaf692a5c76869d.exe	d8093b92969f71e8f5fec5537e0aab1bc06ce493f314f5f0afaf692a5c76869d.exe
PID 4668 wrote to memory of 620	4668	d8093b92969f71e8f5fec5537e0aab1bc06ce493f314f5f0afaf692a5c76869d.exe	d8093b92969f71e8f5fec5537e0aab1bc06ce493f314f5f0afaf692a5c76869d.exe

C:\Users\Admin\AppData\Local\Temp\d8093b92969f71e8f5fec5537e0aab1bc06ce493f314f5f0afaf692a5c76869d.exe
"C:\Users\Admin\AppData\Local\Temp\d8093b92969f71e8f5fec5537e0aab1bc06ce493f314f5f0afaf692a5c76869d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4668

C:\Users\Admin\AppData\Local\Temp\d8093b92969f71e8f5fec5537e0aab1bc06ce493f314f5f0afaf692a5c76869d.exe
watch
2⤵
PID:620

C:\Users\Admin\AppData\Local\Temp\d8093b92969f71e8f5fec5537e0aab1bc06ce493f314f5f0afaf692a5c76869d.exe
start
2⤵
PID:4004

memory/620-132-0x0000000000000000-mapping.dmp

Download
memory/620-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/620-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4004-133-0x0000000000000000-mapping.dmp

Download
memory/4004-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4004-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4668-134-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download