6ea04f74f81b8a18111cee48b89500d908398def35a16aa38200d605233ab5a2

Analysis

max time kernel
172s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:09

Target

6ea04f74f81b8a18111cee48b89500d908398def35a16aa38200d605233ab5a2.exe
Size

522KB
MD5

658c874fd1f27ad70081f92d6cdbe2dd
SHA1

de8889ba7f8456c04a09a11f03211646249e710f
SHA256

6ea04f74f81b8a18111cee48b89500d908398def35a16aa38200d605233ab5a2
SHA512

c3c5f072581643288b3588e32461871af41bd2eb38c7981a5fcf296099e4905dbbe12baee831002d9de2b62cdb2d03eaacfe5b527ad6584bb7abe475bd42e2d1
SSDEEP

12288:um6suqMgBeVNlGql7/wYYlLPt5oKnWq39be:uJsOdGUglLPt5/Wce

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

6ea04f74f81b8a18111cee48b89500d908398def35a16aa38200d605233ab5a2.exe

description	pid	process	target process
PID 4356 wrote to memory of 2100	4356	6ea04f74f81b8a18111cee48b89500d908398def35a16aa38200d605233ab5a2.exe	6ea04f74f81b8a18111cee48b89500d908398def35a16aa38200d605233ab5a2.exe
PID 4356 wrote to memory of 2100	4356	6ea04f74f81b8a18111cee48b89500d908398def35a16aa38200d605233ab5a2.exe	6ea04f74f81b8a18111cee48b89500d908398def35a16aa38200d605233ab5a2.exe
PID 4356 wrote to memory of 2100	4356	6ea04f74f81b8a18111cee48b89500d908398def35a16aa38200d605233ab5a2.exe	6ea04f74f81b8a18111cee48b89500d908398def35a16aa38200d605233ab5a2.exe
PID 4356 wrote to memory of 2352	4356	6ea04f74f81b8a18111cee48b89500d908398def35a16aa38200d605233ab5a2.exe	6ea04f74f81b8a18111cee48b89500d908398def35a16aa38200d605233ab5a2.exe
PID 4356 wrote to memory of 2352	4356	6ea04f74f81b8a18111cee48b89500d908398def35a16aa38200d605233ab5a2.exe	6ea04f74f81b8a18111cee48b89500d908398def35a16aa38200d605233ab5a2.exe
PID 4356 wrote to memory of 2352	4356	6ea04f74f81b8a18111cee48b89500d908398def35a16aa38200d605233ab5a2.exe	6ea04f74f81b8a18111cee48b89500d908398def35a16aa38200d605233ab5a2.exe

C:\Users\Admin\AppData\Local\Temp\6ea04f74f81b8a18111cee48b89500d908398def35a16aa38200d605233ab5a2.exe
"C:\Users\Admin\AppData\Local\Temp\6ea04f74f81b8a18111cee48b89500d908398def35a16aa38200d605233ab5a2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4356

C:\Users\Admin\AppData\Local\Temp\6ea04f74f81b8a18111cee48b89500d908398def35a16aa38200d605233ab5a2.exe
start
2⤵
PID:2100

C:\Users\Admin\AppData\Local\Temp\6ea04f74f81b8a18111cee48b89500d908398def35a16aa38200d605233ab5a2.exe
watch
2⤵
PID:2352

memory/2100-134-0x0000000000000000-mapping.dmp

Download
memory/2100-136-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2100-138-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2100-140-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2352-133-0x0000000000000000-mapping.dmp

Download
memory/2352-137-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2352-139-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2352-141-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4356-132-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4356-135-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download