5ec620b79785de4ba7d8a20312f38e34bfea00d28e284e79e5ba03fe8d285b7e

Analysis

max time kernel
180s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:12

Target

5ec620b79785de4ba7d8a20312f38e34bfea00d28e284e79e5ba03fe8d285b7e.exe
Size

526KB
MD5

331851a791c563c5daaf6a2a2133c87a
SHA1

5717ecc2bf00159c0d752a7e1f8e27feaebda6af
SHA256

5ec620b79785de4ba7d8a20312f38e34bfea00d28e284e79e5ba03fe8d285b7e
SHA512

df569bb41a0676d87c72440a465bd2f6a3b94d61b31e4a7e9cf96f390a7d012f9be5e466a049c545ad73506b15e7744449ca1d92f98a6b0bb7eb2f1549485ba0
SSDEEP

6144:ExEOU6d+6MS8o4u3qmqoE2rRmZMfeUzazU3mQy1CrxQqD9RSaSz+8O593Se:f646LtqoAMfeUuzQy18xQqpx8O5931

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

5ec620b79785de4ba7d8a20312f38e34bfea00d28e284e79e5ba03fe8d285b7e.exe

description	pid	process	target process
PID 1044 wrote to memory of 4256	1044	5ec620b79785de4ba7d8a20312f38e34bfea00d28e284e79e5ba03fe8d285b7e.exe	5ec620b79785de4ba7d8a20312f38e34bfea00d28e284e79e5ba03fe8d285b7e.exe
PID 1044 wrote to memory of 4256	1044	5ec620b79785de4ba7d8a20312f38e34bfea00d28e284e79e5ba03fe8d285b7e.exe	5ec620b79785de4ba7d8a20312f38e34bfea00d28e284e79e5ba03fe8d285b7e.exe
PID 1044 wrote to memory of 4256	1044	5ec620b79785de4ba7d8a20312f38e34bfea00d28e284e79e5ba03fe8d285b7e.exe	5ec620b79785de4ba7d8a20312f38e34bfea00d28e284e79e5ba03fe8d285b7e.exe
PID 1044 wrote to memory of 3532	1044	5ec620b79785de4ba7d8a20312f38e34bfea00d28e284e79e5ba03fe8d285b7e.exe	5ec620b79785de4ba7d8a20312f38e34bfea00d28e284e79e5ba03fe8d285b7e.exe
PID 1044 wrote to memory of 3532	1044	5ec620b79785de4ba7d8a20312f38e34bfea00d28e284e79e5ba03fe8d285b7e.exe	5ec620b79785de4ba7d8a20312f38e34bfea00d28e284e79e5ba03fe8d285b7e.exe
PID 1044 wrote to memory of 3532	1044	5ec620b79785de4ba7d8a20312f38e34bfea00d28e284e79e5ba03fe8d285b7e.exe	5ec620b79785de4ba7d8a20312f38e34bfea00d28e284e79e5ba03fe8d285b7e.exe

C:\Users\Admin\AppData\Local\Temp\5ec620b79785de4ba7d8a20312f38e34bfea00d28e284e79e5ba03fe8d285b7e.exe
"C:\Users\Admin\AppData\Local\Temp\5ec620b79785de4ba7d8a20312f38e34bfea00d28e284e79e5ba03fe8d285b7e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1044

C:\Users\Admin\AppData\Local\Temp\5ec620b79785de4ba7d8a20312f38e34bfea00d28e284e79e5ba03fe8d285b7e.exe
start
2⤵
PID:4256

C:\Users\Admin\AppData\Local\Temp\5ec620b79785de4ba7d8a20312f38e34bfea00d28e284e79e5ba03fe8d285b7e.exe
watch
2⤵
PID:3532

memory/1044-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1044-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3532-133-0x0000000000000000-mapping.dmp

Download
memory/3532-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3532-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3532-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4256-134-0x0000000000000000-mapping.dmp

Download
memory/4256-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4256-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4256-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download