405db6c89b634ae6eb20b847ae6e6859d945dd454d19dbf21a5b25f6eea21c32

Analysis

max time kernel
112s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:16

Target

405db6c89b634ae6eb20b847ae6e6859d945dd454d19dbf21a5b25f6eea21c32.exe
Size

522KB
MD5

64611c7c9b3314fe88acd801f9857021
SHA1

0278fe770145336b25f19158efc5a642d9fbe197
SHA256

405db6c89b634ae6eb20b847ae6e6859d945dd454d19dbf21a5b25f6eea21c32
SHA512

bdfc243ced5a4841bead04e08529fc3dfdfebbda87ba4ef475107b6da59858ecb70e138779cd65d45cac2238bdcf62937702257cabece491fa414bac5973576e
SSDEEP

12288:OvE1ajizRxSeipAsJGwkrEy18xQqpx8O5A:O4l4Agnk4atqpx8

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

405db6c89b634ae6eb20b847ae6e6859d945dd454d19dbf21a5b25f6eea21c32.exe

description	pid	process	target process
PID 5060 wrote to memory of 2556	5060	405db6c89b634ae6eb20b847ae6e6859d945dd454d19dbf21a5b25f6eea21c32.exe	405db6c89b634ae6eb20b847ae6e6859d945dd454d19dbf21a5b25f6eea21c32.exe
PID 5060 wrote to memory of 2556	5060	405db6c89b634ae6eb20b847ae6e6859d945dd454d19dbf21a5b25f6eea21c32.exe	405db6c89b634ae6eb20b847ae6e6859d945dd454d19dbf21a5b25f6eea21c32.exe
PID 5060 wrote to memory of 2556	5060	405db6c89b634ae6eb20b847ae6e6859d945dd454d19dbf21a5b25f6eea21c32.exe	405db6c89b634ae6eb20b847ae6e6859d945dd454d19dbf21a5b25f6eea21c32.exe
PID 5060 wrote to memory of 1756	5060	405db6c89b634ae6eb20b847ae6e6859d945dd454d19dbf21a5b25f6eea21c32.exe	405db6c89b634ae6eb20b847ae6e6859d945dd454d19dbf21a5b25f6eea21c32.exe
PID 5060 wrote to memory of 1756	5060	405db6c89b634ae6eb20b847ae6e6859d945dd454d19dbf21a5b25f6eea21c32.exe	405db6c89b634ae6eb20b847ae6e6859d945dd454d19dbf21a5b25f6eea21c32.exe
PID 5060 wrote to memory of 1756	5060	405db6c89b634ae6eb20b847ae6e6859d945dd454d19dbf21a5b25f6eea21c32.exe	405db6c89b634ae6eb20b847ae6e6859d945dd454d19dbf21a5b25f6eea21c32.exe

C:\Users\Admin\AppData\Local\Temp\405db6c89b634ae6eb20b847ae6e6859d945dd454d19dbf21a5b25f6eea21c32.exe
"C:\Users\Admin\AppData\Local\Temp\405db6c89b634ae6eb20b847ae6e6859d945dd454d19dbf21a5b25f6eea21c32.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5060

C:\Users\Admin\AppData\Local\Temp\405db6c89b634ae6eb20b847ae6e6859d945dd454d19dbf21a5b25f6eea21c32.exe
start
2⤵
PID:2556

C:\Users\Admin\AppData\Local\Temp\405db6c89b634ae6eb20b847ae6e6859d945dd454d19dbf21a5b25f6eea21c32.exe
watch
2⤵
PID:1756

memory/1756-133-0x0000000000000000-mapping.dmp

Download
memory/1756-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1756-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1756-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1756-143-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2556-134-0x0000000000000000-mapping.dmp

Download
memory/2556-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2556-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2556-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2556-142-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/5060-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/5060-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download