3cc8e2894eef57215a983284f0d5b038a4a774b8903b3d823166135f486d6bb3

Analysis

max time kernel
145s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:17

Target

3cc8e2894eef57215a983284f0d5b038a4a774b8903b3d823166135f486d6bb3.exe
Size

522KB
MD5

2475fa12f2a94be96ca2672c52390e8e
SHA1

a7c10efbff14f27788d8889a895111c91fc1b8be
SHA256

3cc8e2894eef57215a983284f0d5b038a4a774b8903b3d823166135f486d6bb3
SHA512

89c37844ad5ba8faf832df0843342eb4aee23dcf5ead32ecaccbef3e47d4adcfe6f60016b1fbe728206565a7d9236da39a07e2925be8a54a2ec7c599ef170c5d
SSDEEP

12288:fXSJx3G8UwuPC1nCzxo4xUupSMrFCsNEfF4S3:fiJx3T71CG4quouFCsNaH3

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

3cc8e2894eef57215a983284f0d5b038a4a774b8903b3d823166135f486d6bb3.exe

description	pid	process	target process
PID 2008 wrote to memory of 2128	2008	3cc8e2894eef57215a983284f0d5b038a4a774b8903b3d823166135f486d6bb3.exe	3cc8e2894eef57215a983284f0d5b038a4a774b8903b3d823166135f486d6bb3.exe
PID 2008 wrote to memory of 2128	2008	3cc8e2894eef57215a983284f0d5b038a4a774b8903b3d823166135f486d6bb3.exe	3cc8e2894eef57215a983284f0d5b038a4a774b8903b3d823166135f486d6bb3.exe
PID 2008 wrote to memory of 2128	2008	3cc8e2894eef57215a983284f0d5b038a4a774b8903b3d823166135f486d6bb3.exe	3cc8e2894eef57215a983284f0d5b038a4a774b8903b3d823166135f486d6bb3.exe
PID 2008 wrote to memory of 1020	2008	3cc8e2894eef57215a983284f0d5b038a4a774b8903b3d823166135f486d6bb3.exe	3cc8e2894eef57215a983284f0d5b038a4a774b8903b3d823166135f486d6bb3.exe
PID 2008 wrote to memory of 1020	2008	3cc8e2894eef57215a983284f0d5b038a4a774b8903b3d823166135f486d6bb3.exe	3cc8e2894eef57215a983284f0d5b038a4a774b8903b3d823166135f486d6bb3.exe
PID 2008 wrote to memory of 1020	2008	3cc8e2894eef57215a983284f0d5b038a4a774b8903b3d823166135f486d6bb3.exe	3cc8e2894eef57215a983284f0d5b038a4a774b8903b3d823166135f486d6bb3.exe

C:\Users\Admin\AppData\Local\Temp\3cc8e2894eef57215a983284f0d5b038a4a774b8903b3d823166135f486d6bb3.exe
"C:\Users\Admin\AppData\Local\Temp\3cc8e2894eef57215a983284f0d5b038a4a774b8903b3d823166135f486d6bb3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2008

C:\Users\Admin\AppData\Local\Temp\3cc8e2894eef57215a983284f0d5b038a4a774b8903b3d823166135f486d6bb3.exe
start
2⤵
PID:2128

C:\Users\Admin\AppData\Local\Temp\3cc8e2894eef57215a983284f0d5b038a4a774b8903b3d823166135f486d6bb3.exe
watch
2⤵
PID:1020

memory/1020-132-0x0000000000000000-mapping.dmp

Download
memory/1020-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1020-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2008-134-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2128-133-0x0000000000000000-mapping.dmp

Download
memory/2128-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2128-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download