6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:10

Target

6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe
Size

522KB
MD5

bcfb9fd9ce7a0ab1127940eaa39f9348
SHA1

eec262e9725917897732c75d5da3c130adc270de
SHA256

6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6
SHA512

40bb6056bf9fd882f7cf6a14ecd95d93f1982a56866604a914d28f1c8c8de0f46a4e0f01f5472983d76dc62435d8cf66715ddfa25cfe57f3c80155213b3fb0fa
SSDEEP

12288:mwwYTIvIOeA1Ojwr1MZ6EBKwYYlLPt5oKnWq3wbw:NIPJwwhq6E9lLPt5/Wdw

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe

description	pid	process	target process
PID 4904 wrote to memory of 4880	4904	6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe	6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe
PID 4904 wrote to memory of 4880	4904	6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe	6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe
PID 4904 wrote to memory of 4880	4904	6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe	6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe
PID 4904 wrote to memory of 4812	4904	6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe	6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe
PID 4904 wrote to memory of 4812	4904	6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe	6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe
PID 4904 wrote to memory of 4812	4904	6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe	6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe

C:\Users\Admin\AppData\Local\Temp\6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe
"C:\Users\Admin\AppData\Local\Temp\6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4904

C:\Users\Admin\AppData\Local\Temp\6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe
start
2⤵
PID:4880

C:\Users\Admin\AppData\Local\Temp\6b4284b339e817ef68dabbc51b2e59cebf7daeac6a7c10fb5c610c047399f4d6.exe
watch
2⤵
PID:4812

memory/4812-133-0x0000000000000000-mapping.dmp

Download
memory/4812-137-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4812-138-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4812-141-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4880-134-0x0000000000000000-mapping.dmp

Download
memory/4880-136-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4880-139-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4880-140-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4904-132-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4904-135-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download