620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c

Analysis

max time kernel
199s
max time network
215s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:11

Target

620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe
Size

522KB
MD5

84b0b72a101164d648fd4d6646e49ae7
SHA1

ede45e64a51d7de94b9de691d982c2a3a89d60b1
SHA256

620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c
SHA512

93fb8d3aa006542c500d6e04a7c9fdfba52a568d537f5b49342e98a39acd550cfe156c386bcab26207056099314ec18247bc581f5021e6ce3f50390efae5f765
SSDEEP

12288:jIo5AwhTUQjK9Y+nAT8a5l8qy18xQqpx8O5fk:jI+JjKex8Iatqpx8f

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe

description	pid	process	target process
PID 216 wrote to memory of 3628	216	620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe	620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe
PID 216 wrote to memory of 3628	216	620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe	620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe
PID 216 wrote to memory of 3628	216	620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe	620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe
PID 216 wrote to memory of 4260	216	620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe	620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe
PID 216 wrote to memory of 4260	216	620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe	620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe
PID 216 wrote to memory of 4260	216	620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe	620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe

C:\Users\Admin\AppData\Local\Temp\620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe
"C:\Users\Admin\AppData\Local\Temp\620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:216

C:\Users\Admin\AppData\Local\Temp\620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe
start
2⤵
PID:3628

C:\Users\Admin\AppData\Local\Temp\620e3ab83754fd9f56388942bfc818705cdcf7a4af2baa1305b89f8c24935d9c.exe
watch
2⤵
PID:4260

memory/216-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/216-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3628-134-0x0000000000000000-mapping.dmp

Download
memory/3628-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3628-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3628-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3628-142-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4260-133-0x0000000000000000-mapping.dmp

Download
memory/4260-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4260-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4260-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4260-143-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download