77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0

Analysis

max time kernel
71s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:07

Target

77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe
Size

518KB
MD5

797974da79fb5017d2f0beff348b8813
SHA1

deaa904d15226c14496e36440ef9219ef77140ee
SHA256

77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0
SHA512

55ace64b6cea981001e07d4109ef3bf9f503da41162958e69e8641f35f4ea0f0bb73b98328ad36f0a2c75924427e1fad00e2bfd5e6b2906396e456317cfcf368
SSDEEP

12288:qnWBdz04JnDqT2QWwYYlLPt5oKnWq3gbz6C:fBdz0MuflLPt5/WZz

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe

description	pid	process	target process
PID 2440 wrote to memory of 4656	2440	77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe	77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe
PID 2440 wrote to memory of 4656	2440	77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe	77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe
PID 2440 wrote to memory of 4656	2440	77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe	77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe
PID 2440 wrote to memory of 4640	2440	77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe	77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe
PID 2440 wrote to memory of 4640	2440	77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe	77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe
PID 2440 wrote to memory of 4640	2440	77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe	77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe

C:\Users\Admin\AppData\Local\Temp\77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe
"C:\Users\Admin\AppData\Local\Temp\77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2440

C:\Users\Admin\AppData\Local\Temp\77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe
start
2⤵
PID:4656

C:\Users\Admin\AppData\Local\Temp\77e688fa10a4817daee15f934461a45a03f2c7d974924fefd2ba5c15bf8064d0.exe
watch
2⤵
PID:4640

memory/2440-132-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2440-135-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4640-133-0x0000000000000000-mapping.dmp

Download
memory/4640-137-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4640-138-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4640-141-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4656-134-0x0000000000000000-mapping.dmp

Download
memory/4656-136-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4656-139-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4656-140-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download