35b6734cca930ca9e1068be16ae1f37d31f5f1c71228c47477b63cbed33a82b4

Analysis

max time kernel
160s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:18

Target

35b6734cca930ca9e1068be16ae1f37d31f5f1c71228c47477b63cbed33a82b4.exe
Size

518KB
MD5

544cbcb838ef5af2786936d4ac6d3dde
SHA1

0db494c3ff2bc88077e10a46879c134f4437ee08
SHA256

35b6734cca930ca9e1068be16ae1f37d31f5f1c71228c47477b63cbed33a82b4
SHA512

1615a536a5393e653510a54eb0bbdce1af648841f1334cec463372999c8703cd61854b6e14d9a0b886901038b11712e84f0eacd411c9e4c2ee6c51155e5ab570
SSDEEP

12288:fFZ5hHDSS90TYIGroKino87wYYlLPt5oKnWq3y/b:tZ5v0TPUoVLglLPt5/WX

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

35b6734cca930ca9e1068be16ae1f37d31f5f1c71228c47477b63cbed33a82b4.exe

description	pid	process	target process
PID 4488 wrote to memory of 3456	4488	35b6734cca930ca9e1068be16ae1f37d31f5f1c71228c47477b63cbed33a82b4.exe	35b6734cca930ca9e1068be16ae1f37d31f5f1c71228c47477b63cbed33a82b4.exe
PID 4488 wrote to memory of 3456	4488	35b6734cca930ca9e1068be16ae1f37d31f5f1c71228c47477b63cbed33a82b4.exe	35b6734cca930ca9e1068be16ae1f37d31f5f1c71228c47477b63cbed33a82b4.exe
PID 4488 wrote to memory of 3456	4488	35b6734cca930ca9e1068be16ae1f37d31f5f1c71228c47477b63cbed33a82b4.exe	35b6734cca930ca9e1068be16ae1f37d31f5f1c71228c47477b63cbed33a82b4.exe
PID 4488 wrote to memory of 2760	4488	35b6734cca930ca9e1068be16ae1f37d31f5f1c71228c47477b63cbed33a82b4.exe	35b6734cca930ca9e1068be16ae1f37d31f5f1c71228c47477b63cbed33a82b4.exe
PID 4488 wrote to memory of 2760	4488	35b6734cca930ca9e1068be16ae1f37d31f5f1c71228c47477b63cbed33a82b4.exe	35b6734cca930ca9e1068be16ae1f37d31f5f1c71228c47477b63cbed33a82b4.exe
PID 4488 wrote to memory of 2760	4488	35b6734cca930ca9e1068be16ae1f37d31f5f1c71228c47477b63cbed33a82b4.exe	35b6734cca930ca9e1068be16ae1f37d31f5f1c71228c47477b63cbed33a82b4.exe

C:\Users\Admin\AppData\Local\Temp\35b6734cca930ca9e1068be16ae1f37d31f5f1c71228c47477b63cbed33a82b4.exe
"C:\Users\Admin\AppData\Local\Temp\35b6734cca930ca9e1068be16ae1f37d31f5f1c71228c47477b63cbed33a82b4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4488

C:\Users\Admin\AppData\Local\Temp\35b6734cca930ca9e1068be16ae1f37d31f5f1c71228c47477b63cbed33a82b4.exe
start
2⤵
PID:3456

C:\Users\Admin\AppData\Local\Temp\35b6734cca930ca9e1068be16ae1f37d31f5f1c71228c47477b63cbed33a82b4.exe
watch
2⤵
PID:2760

memory/2760-133-0x0000000000000000-mapping.dmp

Download
memory/2760-136-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2760-139-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3456-134-0x0000000000000000-mapping.dmp

Download
memory/3456-137-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3456-138-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4488-132-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4488-135-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download