53d7c170e7b327ab3db8bb7cf143cc4999ee370b4c5b14232097480005bb1c77

Analysis

max time kernel
337s
max time network
432s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:13

Target

53d7c170e7b327ab3db8bb7cf143cc4999ee370b4c5b14232097480005bb1c77.exe
Size

522KB
MD5

e9e8b3af88ff913e705290e2316f15fb
SHA1

ecea19e8131693b6ec6bd39a54f89f163bec2f96
SHA256

53d7c170e7b327ab3db8bb7cf143cc4999ee370b4c5b14232097480005bb1c77
SHA512

e1f2eb64c3e1ce8b33b206749991ccda69af4354aa1e66c93f290fb8ca0dfc938488b4032103bcbb420d69381598127001b4ec7ece89d04994c67f2627d9fbf2
SSDEEP

12288:Ffjh0X0kboxsUxwcNl2Hy18xQqpx8O5K:FFkbtawcNl2Hatqpx8

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

53d7c170e7b327ab3db8bb7cf143cc4999ee370b4c5b14232097480005bb1c77.exe

description	pid	process	target process
PID 4384 wrote to memory of 3528	4384	53d7c170e7b327ab3db8bb7cf143cc4999ee370b4c5b14232097480005bb1c77.exe	53d7c170e7b327ab3db8bb7cf143cc4999ee370b4c5b14232097480005bb1c77.exe
PID 4384 wrote to memory of 3528	4384	53d7c170e7b327ab3db8bb7cf143cc4999ee370b4c5b14232097480005bb1c77.exe	53d7c170e7b327ab3db8bb7cf143cc4999ee370b4c5b14232097480005bb1c77.exe
PID 4384 wrote to memory of 3528	4384	53d7c170e7b327ab3db8bb7cf143cc4999ee370b4c5b14232097480005bb1c77.exe	53d7c170e7b327ab3db8bb7cf143cc4999ee370b4c5b14232097480005bb1c77.exe
PID 4384 wrote to memory of 4052	4384	53d7c170e7b327ab3db8bb7cf143cc4999ee370b4c5b14232097480005bb1c77.exe	53d7c170e7b327ab3db8bb7cf143cc4999ee370b4c5b14232097480005bb1c77.exe
PID 4384 wrote to memory of 4052	4384	53d7c170e7b327ab3db8bb7cf143cc4999ee370b4c5b14232097480005bb1c77.exe	53d7c170e7b327ab3db8bb7cf143cc4999ee370b4c5b14232097480005bb1c77.exe
PID 4384 wrote to memory of 4052	4384	53d7c170e7b327ab3db8bb7cf143cc4999ee370b4c5b14232097480005bb1c77.exe	53d7c170e7b327ab3db8bb7cf143cc4999ee370b4c5b14232097480005bb1c77.exe

C:\Users\Admin\AppData\Local\Temp\53d7c170e7b327ab3db8bb7cf143cc4999ee370b4c5b14232097480005bb1c77.exe
"C:\Users\Admin\AppData\Local\Temp\53d7c170e7b327ab3db8bb7cf143cc4999ee370b4c5b14232097480005bb1c77.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4384

C:\Users\Admin\AppData\Local\Temp\53d7c170e7b327ab3db8bb7cf143cc4999ee370b4c5b14232097480005bb1c77.exe
start
2⤵
PID:3528

C:\Users\Admin\AppData\Local\Temp\53d7c170e7b327ab3db8bb7cf143cc4999ee370b4c5b14232097480005bb1c77.exe
watch
2⤵
PID:4052

memory/3528-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3528-135-0x0000000000000000-mapping.dmp

Download
memory/3528-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3528-142-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3528-143-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4052-134-0x0000000000000000-mapping.dmp

Download
memory/4052-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4052-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4052-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4052-144-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4384-133-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4384-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4384-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download