6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992

Analysis

max time kernel
176s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:09

Target

6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe
Size

518KB
MD5

af57a34fb4c06c16429f155e36763558
SHA1

3039548364e9d6bd9b5194ef0b6048aa5f224e31
SHA256

6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992
SHA512

44bbaaf2d4ca435bc305f48b0fee0ab04bb051b7a76aa06ac84c8d406553e845ad36321831dfd6eaa6f3bc90e85acb4f7db66747f3161ee321c0de533f272c4e
SSDEEP

12288:/uMFKJMG72Z5hfFfyw3PwYYlLPt5oKnWq37cby:/dFZFGlLPt5/WaMy

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe

description	pid	process	target process
PID 4164 wrote to memory of 216	4164	6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe	6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe
PID 4164 wrote to memory of 216	4164	6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe	6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe
PID 4164 wrote to memory of 216	4164	6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe	6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe
PID 4164 wrote to memory of 212	4164	6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe	6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe
PID 4164 wrote to memory of 212	4164	6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe	6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe
PID 4164 wrote to memory of 212	4164	6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe	6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe

C:\Users\Admin\AppData\Local\Temp\6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe
"C:\Users\Admin\AppData\Local\Temp\6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4164

C:\Users\Admin\AppData\Local\Temp\6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe
start
2⤵
PID:216

C:\Users\Admin\AppData\Local\Temp\6f45e101a538956c772d186c9b7c72fde82770978d77da417092d79854916992.exe
watch
2⤵
PID:212

memory/212-133-0x0000000000000000-mapping.dmp

Download
memory/212-136-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/212-138-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/212-140-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/212-143-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/216-134-0x0000000000000000-mapping.dmp

Download
memory/216-137-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/216-139-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/216-141-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/216-142-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4164-132-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4164-135-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download