413e513e7cbda002cf53cdeb362900513bb49d27b2e29ac66b5cad2232a1b5d1

Analysis

max time kernel
140s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:16

Target

413e513e7cbda002cf53cdeb362900513bb49d27b2e29ac66b5cad2232a1b5d1.exe
Size

522KB
MD5

8f52a35ac1a14d54c042a14a8f70f72b
SHA1

f6dbafaf8350fc11a404d0a5763986b1db4bcb09
SHA256

413e513e7cbda002cf53cdeb362900513bb49d27b2e29ac66b5cad2232a1b5d1
SHA512

aa18b3f5e500359e6dd6abb2f95b6fed1dec2a0f8f5f3471e8e415e0329298b191de9b60327d63b0210fd674f3c40912e689c59e1eba48924f86b003a4f58140
SSDEEP

12288:ooOH6dwjSYzdH7kCzxo4xUupSMrFCsNEfF4SaM:ROa2jSwR7fG4quouFCsNaHaM

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

413e513e7cbda002cf53cdeb362900513bb49d27b2e29ac66b5cad2232a1b5d1.exe

description	pid	process	target process
PID 2072 wrote to memory of 3104	2072	413e513e7cbda002cf53cdeb362900513bb49d27b2e29ac66b5cad2232a1b5d1.exe	413e513e7cbda002cf53cdeb362900513bb49d27b2e29ac66b5cad2232a1b5d1.exe
PID 2072 wrote to memory of 3104	2072	413e513e7cbda002cf53cdeb362900513bb49d27b2e29ac66b5cad2232a1b5d1.exe	413e513e7cbda002cf53cdeb362900513bb49d27b2e29ac66b5cad2232a1b5d1.exe
PID 2072 wrote to memory of 3104	2072	413e513e7cbda002cf53cdeb362900513bb49d27b2e29ac66b5cad2232a1b5d1.exe	413e513e7cbda002cf53cdeb362900513bb49d27b2e29ac66b5cad2232a1b5d1.exe
PID 2072 wrote to memory of 4616	2072	413e513e7cbda002cf53cdeb362900513bb49d27b2e29ac66b5cad2232a1b5d1.exe	413e513e7cbda002cf53cdeb362900513bb49d27b2e29ac66b5cad2232a1b5d1.exe
PID 2072 wrote to memory of 4616	2072	413e513e7cbda002cf53cdeb362900513bb49d27b2e29ac66b5cad2232a1b5d1.exe	413e513e7cbda002cf53cdeb362900513bb49d27b2e29ac66b5cad2232a1b5d1.exe
PID 2072 wrote to memory of 4616	2072	413e513e7cbda002cf53cdeb362900513bb49d27b2e29ac66b5cad2232a1b5d1.exe	413e513e7cbda002cf53cdeb362900513bb49d27b2e29ac66b5cad2232a1b5d1.exe

C:\Users\Admin\AppData\Local\Temp\413e513e7cbda002cf53cdeb362900513bb49d27b2e29ac66b5cad2232a1b5d1.exe
"C:\Users\Admin\AppData\Local\Temp\413e513e7cbda002cf53cdeb362900513bb49d27b2e29ac66b5cad2232a1b5d1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2072

C:\Users\Admin\AppData\Local\Temp\413e513e7cbda002cf53cdeb362900513bb49d27b2e29ac66b5cad2232a1b5d1.exe
start
2⤵
PID:3104

C:\Users\Admin\AppData\Local\Temp\413e513e7cbda002cf53cdeb362900513bb49d27b2e29ac66b5cad2232a1b5d1.exe
watch
2⤵
PID:4616

memory/2072-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2072-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3104-134-0x0000000000000000-mapping.dmp

Download
memory/3104-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3104-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4616-133-0x0000000000000000-mapping.dmp

Download
memory/4616-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4616-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download