5aba15a0219e3bf419d5cd6df83219b48ea9910566353f1f172e9112b2b9ace4

Analysis

max time kernel
150s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:12

Target

5aba15a0219e3bf419d5cd6df83219b48ea9910566353f1f172e9112b2b9ace4.exe
Size

518KB
MD5

0f48147765c9f2d6061848176676cb6d
SHA1

ba77a3e3c6f5f5c19ba3a60041bdf7ae84b1a4ee
SHA256

5aba15a0219e3bf419d5cd6df83219b48ea9910566353f1f172e9112b2b9ace4
SHA512

83fbff75cc5d5f695a691d89eb85132020079bb23b9ae3dd35e716a2c1c3e3a461c157ffd83161cb40ab55b173c7f8051a24349f40ddc85643eaad8a330d5bf8
SSDEEP

12288:ieWbofC7r5arE+9q4Gc4WwYYlLPt5oKnWq3ab:kEC7rcEiqlLPt5/W7

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

5aba15a0219e3bf419d5cd6df83219b48ea9910566353f1f172e9112b2b9ace4.exe

description	pid	process	target process
PID 1008 wrote to memory of 2680	1008	5aba15a0219e3bf419d5cd6df83219b48ea9910566353f1f172e9112b2b9ace4.exe	5aba15a0219e3bf419d5cd6df83219b48ea9910566353f1f172e9112b2b9ace4.exe
PID 1008 wrote to memory of 2680	1008	5aba15a0219e3bf419d5cd6df83219b48ea9910566353f1f172e9112b2b9ace4.exe	5aba15a0219e3bf419d5cd6df83219b48ea9910566353f1f172e9112b2b9ace4.exe
PID 1008 wrote to memory of 2680	1008	5aba15a0219e3bf419d5cd6df83219b48ea9910566353f1f172e9112b2b9ace4.exe	5aba15a0219e3bf419d5cd6df83219b48ea9910566353f1f172e9112b2b9ace4.exe
PID 1008 wrote to memory of 4112	1008	5aba15a0219e3bf419d5cd6df83219b48ea9910566353f1f172e9112b2b9ace4.exe	5aba15a0219e3bf419d5cd6df83219b48ea9910566353f1f172e9112b2b9ace4.exe
PID 1008 wrote to memory of 4112	1008	5aba15a0219e3bf419d5cd6df83219b48ea9910566353f1f172e9112b2b9ace4.exe	5aba15a0219e3bf419d5cd6df83219b48ea9910566353f1f172e9112b2b9ace4.exe
PID 1008 wrote to memory of 4112	1008	5aba15a0219e3bf419d5cd6df83219b48ea9910566353f1f172e9112b2b9ace4.exe	5aba15a0219e3bf419d5cd6df83219b48ea9910566353f1f172e9112b2b9ace4.exe

C:\Users\Admin\AppData\Local\Temp\5aba15a0219e3bf419d5cd6df83219b48ea9910566353f1f172e9112b2b9ace4.exe
"C:\Users\Admin\AppData\Local\Temp\5aba15a0219e3bf419d5cd6df83219b48ea9910566353f1f172e9112b2b9ace4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1008

C:\Users\Admin\AppData\Local\Temp\5aba15a0219e3bf419d5cd6df83219b48ea9910566353f1f172e9112b2b9ace4.exe
watch
2⤵
PID:4112

C:\Users\Admin\AppData\Local\Temp\5aba15a0219e3bf419d5cd6df83219b48ea9910566353f1f172e9112b2b9ace4.exe
start
2⤵
PID:2680

memory/1008-132-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1008-133-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1008-136-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2680-135-0x0000000000000000-mapping.dmp

Download
memory/2680-138-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2680-140-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4112-134-0x0000000000000000-mapping.dmp

Download
memory/4112-137-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4112-139-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4112-141-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download