684e47ef163714ec296bf00499592d7beb8f68f0e96b13504e5d1c04268d9584

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:10

Target

684e47ef163714ec296bf00499592d7beb8f68f0e96b13504e5d1c04268d9584.exe
Size

522KB
MD5

4cff000fe14e96c259e3981ad9eff045
SHA1

5f3bbe2f753abaa11f831d8fd313bf5709f09fcb
SHA256

684e47ef163714ec296bf00499592d7beb8f68f0e96b13504e5d1c04268d9584
SHA512

2368ea8e30372b39219032409520443f1e89815ed2489e73aa4b000fa94d0331fbdecd2445c7d5e559608fb660a3ecfee3a44eea08dabe9d185b2187a2eaaabe
SSDEEP

12288:yH/9e7sqdgF7SqFKVA0y18xQqpx8O5Am6C:yf9e4b1SA0atqpx8a

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

684e47ef163714ec296bf00499592d7beb8f68f0e96b13504e5d1c04268d9584.exe

description	pid	process	target process
PID 4152 wrote to memory of 4352	4152	684e47ef163714ec296bf00499592d7beb8f68f0e96b13504e5d1c04268d9584.exe	684e47ef163714ec296bf00499592d7beb8f68f0e96b13504e5d1c04268d9584.exe
PID 4152 wrote to memory of 4352	4152	684e47ef163714ec296bf00499592d7beb8f68f0e96b13504e5d1c04268d9584.exe	684e47ef163714ec296bf00499592d7beb8f68f0e96b13504e5d1c04268d9584.exe
PID 4152 wrote to memory of 4352	4152	684e47ef163714ec296bf00499592d7beb8f68f0e96b13504e5d1c04268d9584.exe	684e47ef163714ec296bf00499592d7beb8f68f0e96b13504e5d1c04268d9584.exe
PID 4152 wrote to memory of 3344	4152	684e47ef163714ec296bf00499592d7beb8f68f0e96b13504e5d1c04268d9584.exe	684e47ef163714ec296bf00499592d7beb8f68f0e96b13504e5d1c04268d9584.exe
PID 4152 wrote to memory of 3344	4152	684e47ef163714ec296bf00499592d7beb8f68f0e96b13504e5d1c04268d9584.exe	684e47ef163714ec296bf00499592d7beb8f68f0e96b13504e5d1c04268d9584.exe
PID 4152 wrote to memory of 3344	4152	684e47ef163714ec296bf00499592d7beb8f68f0e96b13504e5d1c04268d9584.exe	684e47ef163714ec296bf00499592d7beb8f68f0e96b13504e5d1c04268d9584.exe

C:\Users\Admin\AppData\Local\Temp\684e47ef163714ec296bf00499592d7beb8f68f0e96b13504e5d1c04268d9584.exe
"C:\Users\Admin\AppData\Local\Temp\684e47ef163714ec296bf00499592d7beb8f68f0e96b13504e5d1c04268d9584.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4152

C:\Users\Admin\AppData\Local\Temp\684e47ef163714ec296bf00499592d7beb8f68f0e96b13504e5d1c04268d9584.exe
start
2⤵
PID:4352

C:\Users\Admin\AppData\Local\Temp\684e47ef163714ec296bf00499592d7beb8f68f0e96b13504e5d1c04268d9584.exe
watch
2⤵
PID:3344

memory/3344-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3344-134-0x0000000000000000-mapping.dmp

Download
memory/3344-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3344-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3344-144-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4152-133-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4152-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4152-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4352-135-0x0000000000000000-mapping.dmp

Download
memory/4352-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4352-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4352-142-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4352-143-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download