52aaeaf08092699fba408521d31627ea9a47b3cb60c11e8c217b8bc89ba39036

Analysis

max time kernel
275s
max time network
403s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:14

Target

52aaeaf08092699fba408521d31627ea9a47b3cb60c11e8c217b8bc89ba39036.exe
Size

522KB
MD5

7bd01563eb0f321ae7a40df9763ba6a7
SHA1

26f861b0dc11b232a98be04c1b033fd9ac4658a9
SHA256

52aaeaf08092699fba408521d31627ea9a47b3cb60c11e8c217b8bc89ba39036
SHA512

22ba851f9b4c8b268f7bcb67f6a8987081b7aa8a69794b261974f9f4923c029738db48f77d42f85914645191b763c6060af9fe1d382eddfd84688a0b2a90bafc
SSDEEP

12288:CTG6sMRt93J5LZnFaeVjQy18xQqpx8O51/:kG6sMJvlFaeaatqpx8

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

52aaeaf08092699fba408521d31627ea9a47b3cb60c11e8c217b8bc89ba39036.exe

description	pid	process	target process
PID 4720 wrote to memory of 4544	4720	52aaeaf08092699fba408521d31627ea9a47b3cb60c11e8c217b8bc89ba39036.exe	52aaeaf08092699fba408521d31627ea9a47b3cb60c11e8c217b8bc89ba39036.exe
PID 4720 wrote to memory of 4544	4720	52aaeaf08092699fba408521d31627ea9a47b3cb60c11e8c217b8bc89ba39036.exe	52aaeaf08092699fba408521d31627ea9a47b3cb60c11e8c217b8bc89ba39036.exe
PID 4720 wrote to memory of 4544	4720	52aaeaf08092699fba408521d31627ea9a47b3cb60c11e8c217b8bc89ba39036.exe	52aaeaf08092699fba408521d31627ea9a47b3cb60c11e8c217b8bc89ba39036.exe
PID 4720 wrote to memory of 1376	4720	52aaeaf08092699fba408521d31627ea9a47b3cb60c11e8c217b8bc89ba39036.exe	52aaeaf08092699fba408521d31627ea9a47b3cb60c11e8c217b8bc89ba39036.exe
PID 4720 wrote to memory of 1376	4720	52aaeaf08092699fba408521d31627ea9a47b3cb60c11e8c217b8bc89ba39036.exe	52aaeaf08092699fba408521d31627ea9a47b3cb60c11e8c217b8bc89ba39036.exe
PID 4720 wrote to memory of 1376	4720	52aaeaf08092699fba408521d31627ea9a47b3cb60c11e8c217b8bc89ba39036.exe	52aaeaf08092699fba408521d31627ea9a47b3cb60c11e8c217b8bc89ba39036.exe

C:\Users\Admin\AppData\Local\Temp\52aaeaf08092699fba408521d31627ea9a47b3cb60c11e8c217b8bc89ba39036.exe
"C:\Users\Admin\AppData\Local\Temp\52aaeaf08092699fba408521d31627ea9a47b3cb60c11e8c217b8bc89ba39036.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4720

C:\Users\Admin\AppData\Local\Temp\52aaeaf08092699fba408521d31627ea9a47b3cb60c11e8c217b8bc89ba39036.exe
start
2⤵
PID:4544

C:\Users\Admin\AppData\Local\Temp\52aaeaf08092699fba408521d31627ea9a47b3cb60c11e8c217b8bc89ba39036.exe
watch
2⤵
PID:1376

memory/1376-134-0x0000000000000000-mapping.dmp

Download
memory/1376-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1376-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1376-142-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4544-135-0x0000000000000000-mapping.dmp

Download
memory/4544-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4544-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4544-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4720-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4720-133-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4720-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download