3098c1a0783f10893f6c66b98b139859c2e1791bb4e081b060ad946f294f3c24

Analysis

max time kernel
154s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:18

Target

3098c1a0783f10893f6c66b98b139859c2e1791bb4e081b060ad946f294f3c24.exe
Size

522KB
MD5

a464bf62815bb6171aa5f8991e3b9f71
SHA1

5875fa4e19056898be8f2693283e33a18f228245
SHA256

3098c1a0783f10893f6c66b98b139859c2e1791bb4e081b060ad946f294f3c24
SHA512

93ba7ca89a37ff549cdd26c98e9c23aa9186e1227c548b7d8ef568c6b62f7fb63f4227190cb51ca89965758abc5940770552768ee4e7cce5b51738c4c1e52303
SSDEEP

6144:C1ky0rN1TM2IqRsTinoyIKFfDbSfxaPd1CRQzJP6/9wXLmrmQy1CrxQqD9RSaSzQ:+IMiOiLIefF1fzA9wqBy18xQqpx8O5/

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

3098c1a0783f10893f6c66b98b139859c2e1791bb4e081b060ad946f294f3c24.exe

description	pid	process	target process
PID 3228 wrote to memory of 1824	3228	3098c1a0783f10893f6c66b98b139859c2e1791bb4e081b060ad946f294f3c24.exe	3098c1a0783f10893f6c66b98b139859c2e1791bb4e081b060ad946f294f3c24.exe
PID 3228 wrote to memory of 1824	3228	3098c1a0783f10893f6c66b98b139859c2e1791bb4e081b060ad946f294f3c24.exe	3098c1a0783f10893f6c66b98b139859c2e1791bb4e081b060ad946f294f3c24.exe
PID 3228 wrote to memory of 1824	3228	3098c1a0783f10893f6c66b98b139859c2e1791bb4e081b060ad946f294f3c24.exe	3098c1a0783f10893f6c66b98b139859c2e1791bb4e081b060ad946f294f3c24.exe
PID 3228 wrote to memory of 4412	3228	3098c1a0783f10893f6c66b98b139859c2e1791bb4e081b060ad946f294f3c24.exe	3098c1a0783f10893f6c66b98b139859c2e1791bb4e081b060ad946f294f3c24.exe
PID 3228 wrote to memory of 4412	3228	3098c1a0783f10893f6c66b98b139859c2e1791bb4e081b060ad946f294f3c24.exe	3098c1a0783f10893f6c66b98b139859c2e1791bb4e081b060ad946f294f3c24.exe
PID 3228 wrote to memory of 4412	3228	3098c1a0783f10893f6c66b98b139859c2e1791bb4e081b060ad946f294f3c24.exe	3098c1a0783f10893f6c66b98b139859c2e1791bb4e081b060ad946f294f3c24.exe

C:\Users\Admin\AppData\Local\Temp\3098c1a0783f10893f6c66b98b139859c2e1791bb4e081b060ad946f294f3c24.exe
"C:\Users\Admin\AppData\Local\Temp\3098c1a0783f10893f6c66b98b139859c2e1791bb4e081b060ad946f294f3c24.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3228

C:\Users\Admin\AppData\Local\Temp\3098c1a0783f10893f6c66b98b139859c2e1791bb4e081b060ad946f294f3c24.exe
start
2⤵
PID:1824

C:\Users\Admin\AppData\Local\Temp\3098c1a0783f10893f6c66b98b139859c2e1791bb4e081b060ad946f294f3c24.exe
watch
2⤵
PID:4412

memory/1824-134-0x0000000000000000-mapping.dmp

Download
memory/1824-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1824-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1824-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1824-142-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3228-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3228-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4412-133-0x0000000000000000-mapping.dmp

Download
memory/4412-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4412-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4412-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4412-143-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download