71c78e96c08cf68d76cc118cf5ffb289aac4fd5ad260bd3e218653ec886179d6

Analysis

max time kernel
196s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:08

Target

71c78e96c08cf68d76cc118cf5ffb289aac4fd5ad260bd3e218653ec886179d6.exe
Size

522KB
MD5

d1d136a90ed30d15615670b12a7f0e28
SHA1

ffb66d62f156d84cebfdeafd95156498acf158a0
SHA256

71c78e96c08cf68d76cc118cf5ffb289aac4fd5ad260bd3e218653ec886179d6
SHA512

1f83a6f57ef7a38e310c4947a2582c5294eaaf026c4cbd6b603779da4003f9370ebb8c751ba555a0d8837e93c20cdc91699b569ac5bf274279b90677608b4658
SSDEEP

12288:aNTS5G9AyUTq0bddg8VtCzxo4xUupSMrFCsNEfF4SmJ56C:rGuvTqyddg8VkG4quouFCsNaHmJ5

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

71c78e96c08cf68d76cc118cf5ffb289aac4fd5ad260bd3e218653ec886179d6.exe

description	pid	process	target process
PID 1752 wrote to memory of 3052	1752	71c78e96c08cf68d76cc118cf5ffb289aac4fd5ad260bd3e218653ec886179d6.exe	71c78e96c08cf68d76cc118cf5ffb289aac4fd5ad260bd3e218653ec886179d6.exe
PID 1752 wrote to memory of 3052	1752	71c78e96c08cf68d76cc118cf5ffb289aac4fd5ad260bd3e218653ec886179d6.exe	71c78e96c08cf68d76cc118cf5ffb289aac4fd5ad260bd3e218653ec886179d6.exe
PID 1752 wrote to memory of 3052	1752	71c78e96c08cf68d76cc118cf5ffb289aac4fd5ad260bd3e218653ec886179d6.exe	71c78e96c08cf68d76cc118cf5ffb289aac4fd5ad260bd3e218653ec886179d6.exe
PID 1752 wrote to memory of 3208	1752	71c78e96c08cf68d76cc118cf5ffb289aac4fd5ad260bd3e218653ec886179d6.exe	71c78e96c08cf68d76cc118cf5ffb289aac4fd5ad260bd3e218653ec886179d6.exe
PID 1752 wrote to memory of 3208	1752	71c78e96c08cf68d76cc118cf5ffb289aac4fd5ad260bd3e218653ec886179d6.exe	71c78e96c08cf68d76cc118cf5ffb289aac4fd5ad260bd3e218653ec886179d6.exe
PID 1752 wrote to memory of 3208	1752	71c78e96c08cf68d76cc118cf5ffb289aac4fd5ad260bd3e218653ec886179d6.exe	71c78e96c08cf68d76cc118cf5ffb289aac4fd5ad260bd3e218653ec886179d6.exe

C:\Users\Admin\AppData\Local\Temp\71c78e96c08cf68d76cc118cf5ffb289aac4fd5ad260bd3e218653ec886179d6.exe
"C:\Users\Admin\AppData\Local\Temp\71c78e96c08cf68d76cc118cf5ffb289aac4fd5ad260bd3e218653ec886179d6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1752

C:\Users\Admin\AppData\Local\Temp\71c78e96c08cf68d76cc118cf5ffb289aac4fd5ad260bd3e218653ec886179d6.exe
start
2⤵
PID:3052

C:\Users\Admin\AppData\Local\Temp\71c78e96c08cf68d76cc118cf5ffb289aac4fd5ad260bd3e218653ec886179d6.exe
watch
2⤵
PID:3208

memory/1752-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1752-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3052-134-0x0000000000000000-mapping.dmp

Download
memory/3052-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3052-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3208-133-0x0000000000000000-mapping.dmp

Download
memory/3208-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3208-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download