3ec0547ba88027e4eb8be192edbf94f132e689c201325e6c78e64769852ab129

Analysis

max time kernel
172s
max time network
227s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:16

Target

3ec0547ba88027e4eb8be192edbf94f132e689c201325e6c78e64769852ab129.exe
Size

522KB
MD5

579be3738447994d41c0739633a2a2f4
SHA1

2a04d3cb4ace63ba12018772b86fd699738b7e3b
SHA256

3ec0547ba88027e4eb8be192edbf94f132e689c201325e6c78e64769852ab129
SHA512

5c646eb102f593fa6351ec140184aa4241d012b964822be59183fb586ae6988720939f3c7c1b8c1397fce04bde4bc4b82318a536e2e0548b1d5da169aa6656c5
SSDEEP

6144:9iTEnl9QHOYN9vMAqGq9e+unmOw83GPHVKL5qhTG5Bj0umQy1CrxQqD9RSaSz+8x:NNgpqFhHmOyQmy18xQqpx8O5m

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

3ec0547ba88027e4eb8be192edbf94f132e689c201325e6c78e64769852ab129.exe

description	pid	process	target process
PID 1716 wrote to memory of 4260	1716	3ec0547ba88027e4eb8be192edbf94f132e689c201325e6c78e64769852ab129.exe	3ec0547ba88027e4eb8be192edbf94f132e689c201325e6c78e64769852ab129.exe
PID 1716 wrote to memory of 4260	1716	3ec0547ba88027e4eb8be192edbf94f132e689c201325e6c78e64769852ab129.exe	3ec0547ba88027e4eb8be192edbf94f132e689c201325e6c78e64769852ab129.exe
PID 1716 wrote to memory of 4260	1716	3ec0547ba88027e4eb8be192edbf94f132e689c201325e6c78e64769852ab129.exe	3ec0547ba88027e4eb8be192edbf94f132e689c201325e6c78e64769852ab129.exe
PID 1716 wrote to memory of 4328	1716	3ec0547ba88027e4eb8be192edbf94f132e689c201325e6c78e64769852ab129.exe	3ec0547ba88027e4eb8be192edbf94f132e689c201325e6c78e64769852ab129.exe
PID 1716 wrote to memory of 4328	1716	3ec0547ba88027e4eb8be192edbf94f132e689c201325e6c78e64769852ab129.exe	3ec0547ba88027e4eb8be192edbf94f132e689c201325e6c78e64769852ab129.exe
PID 1716 wrote to memory of 4328	1716	3ec0547ba88027e4eb8be192edbf94f132e689c201325e6c78e64769852ab129.exe	3ec0547ba88027e4eb8be192edbf94f132e689c201325e6c78e64769852ab129.exe

C:\Users\Admin\AppData\Local\Temp\3ec0547ba88027e4eb8be192edbf94f132e689c201325e6c78e64769852ab129.exe
"C:\Users\Admin\AppData\Local\Temp\3ec0547ba88027e4eb8be192edbf94f132e689c201325e6c78e64769852ab129.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1716

C:\Users\Admin\AppData\Local\Temp\3ec0547ba88027e4eb8be192edbf94f132e689c201325e6c78e64769852ab129.exe
start
2⤵
PID:4260

C:\Users\Admin\AppData\Local\Temp\3ec0547ba88027e4eb8be192edbf94f132e689c201325e6c78e64769852ab129.exe
watch
2⤵
PID:4328

memory/1716-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1716-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4260-134-0x0000000000000000-mapping.dmp

Download
memory/4260-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4260-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4260-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4328-133-0x0000000000000000-mapping.dmp

Download
memory/4328-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4328-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4328-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download