4c51bb62938735f8beb22009cfe9d22c870e4ab5f9fcf2cc8cd674d02f84d49b

Analysis

max time kernel
171s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:14

Target

4c51bb62938735f8beb22009cfe9d22c870e4ab5f9fcf2cc8cd674d02f84d49b.exe
Size

522KB
MD5

92dd5cc2f2ddd8525c075ec6825990c5
SHA1

fd39c566d13ed2bd68323eef33c3a963118d0ab2
SHA256

4c51bb62938735f8beb22009cfe9d22c870e4ab5f9fcf2cc8cd674d02f84d49b
SHA512

5c054e6f8d01e0ea1329ec4fc9b2efcf02639386e1ece8d3545cf0a7af5b2bb62cc8f449eecc007206ec936d89102e7de93d233c9455c70fcd7cabcdfbc57501
SSDEEP

6144:lG7wkLMdA9qcCYQ9AFzA19nlKPHzlhtwbITit2ZMl/3mQy1CrxQqD9RSaSz+8O5u:MwcMWtqaFWUvhneAWFy18xQqpx8O5J

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

4c51bb62938735f8beb22009cfe9d22c870e4ab5f9fcf2cc8cd674d02f84d49b.exe

description	pid	process	target process
PID 4064 wrote to memory of 4688	4064	4c51bb62938735f8beb22009cfe9d22c870e4ab5f9fcf2cc8cd674d02f84d49b.exe	4c51bb62938735f8beb22009cfe9d22c870e4ab5f9fcf2cc8cd674d02f84d49b.exe
PID 4064 wrote to memory of 4688	4064	4c51bb62938735f8beb22009cfe9d22c870e4ab5f9fcf2cc8cd674d02f84d49b.exe	4c51bb62938735f8beb22009cfe9d22c870e4ab5f9fcf2cc8cd674d02f84d49b.exe
PID 4064 wrote to memory of 4688	4064	4c51bb62938735f8beb22009cfe9d22c870e4ab5f9fcf2cc8cd674d02f84d49b.exe	4c51bb62938735f8beb22009cfe9d22c870e4ab5f9fcf2cc8cd674d02f84d49b.exe
PID 4064 wrote to memory of 4136	4064	4c51bb62938735f8beb22009cfe9d22c870e4ab5f9fcf2cc8cd674d02f84d49b.exe	4c51bb62938735f8beb22009cfe9d22c870e4ab5f9fcf2cc8cd674d02f84d49b.exe
PID 4064 wrote to memory of 4136	4064	4c51bb62938735f8beb22009cfe9d22c870e4ab5f9fcf2cc8cd674d02f84d49b.exe	4c51bb62938735f8beb22009cfe9d22c870e4ab5f9fcf2cc8cd674d02f84d49b.exe
PID 4064 wrote to memory of 4136	4064	4c51bb62938735f8beb22009cfe9d22c870e4ab5f9fcf2cc8cd674d02f84d49b.exe	4c51bb62938735f8beb22009cfe9d22c870e4ab5f9fcf2cc8cd674d02f84d49b.exe

C:\Users\Admin\AppData\Local\Temp\4c51bb62938735f8beb22009cfe9d22c870e4ab5f9fcf2cc8cd674d02f84d49b.exe
"C:\Users\Admin\AppData\Local\Temp\4c51bb62938735f8beb22009cfe9d22c870e4ab5f9fcf2cc8cd674d02f84d49b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4064

C:\Users\Admin\AppData\Local\Temp\4c51bb62938735f8beb22009cfe9d22c870e4ab5f9fcf2cc8cd674d02f84d49b.exe
start
2⤵
PID:4688

C:\Users\Admin\AppData\Local\Temp\4c51bb62938735f8beb22009cfe9d22c870e4ab5f9fcf2cc8cd674d02f84d49b.exe
watch
2⤵
PID:4136

memory/4064-133-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4064-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4064-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4136-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4136-134-0x0000000000000000-mapping.dmp

Download
memory/4136-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4136-144-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4136-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4688-135-0x0000000000000000-mapping.dmp

Download
memory/4688-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4688-142-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4688-143-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4688-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download