6bea606315f6940af855fe484b17ca78b5f8dcebfd23e12d6a7c6f24776dd611

Analysis

max time kernel
230s
max time network
287s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:09

Target

6bea606315f6940af855fe484b17ca78b5f8dcebfd23e12d6a7c6f24776dd611.exe
Size

526KB
MD5

552ea5e05f82a71b59d98298e468a5f5
SHA1

35c9cb73ee8504c1e00fba6a4d23ff2386038cbe
SHA256

6bea606315f6940af855fe484b17ca78b5f8dcebfd23e12d6a7c6f24776dd611
SHA512

5f215aa86beac1c84fe885f8542f9698d5f564ba2d15146fb1549bb04933e43bf462360bf6103f79efbb13a04fb0ae2e0ba42ebcc13a62800fb6eb564577bb53
SSDEEP

12288:i83eRu+6KCQxnq8I6o6g6y18xQqpx8O5nz:fO96snq8I5J6atqpx8s

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

6bea606315f6940af855fe484b17ca78b5f8dcebfd23e12d6a7c6f24776dd611.exe

description	pid	process	target process
PID 4744 wrote to memory of 1612	4744	6bea606315f6940af855fe484b17ca78b5f8dcebfd23e12d6a7c6f24776dd611.exe	6bea606315f6940af855fe484b17ca78b5f8dcebfd23e12d6a7c6f24776dd611.exe
PID 4744 wrote to memory of 1612	4744	6bea606315f6940af855fe484b17ca78b5f8dcebfd23e12d6a7c6f24776dd611.exe	6bea606315f6940af855fe484b17ca78b5f8dcebfd23e12d6a7c6f24776dd611.exe
PID 4744 wrote to memory of 1612	4744	6bea606315f6940af855fe484b17ca78b5f8dcebfd23e12d6a7c6f24776dd611.exe	6bea606315f6940af855fe484b17ca78b5f8dcebfd23e12d6a7c6f24776dd611.exe
PID 4744 wrote to memory of 2924	4744	6bea606315f6940af855fe484b17ca78b5f8dcebfd23e12d6a7c6f24776dd611.exe	6bea606315f6940af855fe484b17ca78b5f8dcebfd23e12d6a7c6f24776dd611.exe
PID 4744 wrote to memory of 2924	4744	6bea606315f6940af855fe484b17ca78b5f8dcebfd23e12d6a7c6f24776dd611.exe	6bea606315f6940af855fe484b17ca78b5f8dcebfd23e12d6a7c6f24776dd611.exe
PID 4744 wrote to memory of 2924	4744	6bea606315f6940af855fe484b17ca78b5f8dcebfd23e12d6a7c6f24776dd611.exe	6bea606315f6940af855fe484b17ca78b5f8dcebfd23e12d6a7c6f24776dd611.exe

C:\Users\Admin\AppData\Local\Temp\6bea606315f6940af855fe484b17ca78b5f8dcebfd23e12d6a7c6f24776dd611.exe
"C:\Users\Admin\AppData\Local\Temp\6bea606315f6940af855fe484b17ca78b5f8dcebfd23e12d6a7c6f24776dd611.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4744

C:\Users\Admin\AppData\Local\Temp\6bea606315f6940af855fe484b17ca78b5f8dcebfd23e12d6a7c6f24776dd611.exe
start
2⤵
PID:1612

C:\Users\Admin\AppData\Local\Temp\6bea606315f6940af855fe484b17ca78b5f8dcebfd23e12d6a7c6f24776dd611.exe
watch
2⤵
PID:2924

memory/1612-135-0x0000000000000000-mapping.dmp

Download
memory/1612-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1612-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2924-134-0x0000000000000000-mapping.dmp

Download
memory/2924-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2924-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4744-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4744-133-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4744-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download