271bc266fd2420c1bce9108208c4a3bd8a5445d93ea641833de0286e43f8476d

Analysis

max time kernel
177s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:20

Target

271bc266fd2420c1bce9108208c4a3bd8a5445d93ea641833de0286e43f8476d.exe
Size

518KB
MD5

04b54f4a1a74f58f7546bc5cb4147ebd
SHA1

82ae6988482936a8aa7a4483b62ac542473fb9cf
SHA256

271bc266fd2420c1bce9108208c4a3bd8a5445d93ea641833de0286e43f8476d
SHA512

0c9f755e2e4fd13c1129f5826d55fd2e7acbc3fa64d9e9d6e132cfd1900556f05e2a7d3ac7d4eb15a39e9db827e44d75f6dcb962fd713e61d7665ba9bcb50514
SSDEEP

12288:oADR9wM/HEHLtJ6y2wYYlLPt5oKnWq3Eb:NVj2LtJFlLPt5/Wl

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

271bc266fd2420c1bce9108208c4a3bd8a5445d93ea641833de0286e43f8476d.exe

description	pid	process	target process
PID 2980 wrote to memory of 1504	2980	271bc266fd2420c1bce9108208c4a3bd8a5445d93ea641833de0286e43f8476d.exe	271bc266fd2420c1bce9108208c4a3bd8a5445d93ea641833de0286e43f8476d.exe
PID 2980 wrote to memory of 1504	2980	271bc266fd2420c1bce9108208c4a3bd8a5445d93ea641833de0286e43f8476d.exe	271bc266fd2420c1bce9108208c4a3bd8a5445d93ea641833de0286e43f8476d.exe
PID 2980 wrote to memory of 1504	2980	271bc266fd2420c1bce9108208c4a3bd8a5445d93ea641833de0286e43f8476d.exe	271bc266fd2420c1bce9108208c4a3bd8a5445d93ea641833de0286e43f8476d.exe
PID 2980 wrote to memory of 3640	2980	271bc266fd2420c1bce9108208c4a3bd8a5445d93ea641833de0286e43f8476d.exe	271bc266fd2420c1bce9108208c4a3bd8a5445d93ea641833de0286e43f8476d.exe
PID 2980 wrote to memory of 3640	2980	271bc266fd2420c1bce9108208c4a3bd8a5445d93ea641833de0286e43f8476d.exe	271bc266fd2420c1bce9108208c4a3bd8a5445d93ea641833de0286e43f8476d.exe
PID 2980 wrote to memory of 3640	2980	271bc266fd2420c1bce9108208c4a3bd8a5445d93ea641833de0286e43f8476d.exe	271bc266fd2420c1bce9108208c4a3bd8a5445d93ea641833de0286e43f8476d.exe

C:\Users\Admin\AppData\Local\Temp\271bc266fd2420c1bce9108208c4a3bd8a5445d93ea641833de0286e43f8476d.exe
"C:\Users\Admin\AppData\Local\Temp\271bc266fd2420c1bce9108208c4a3bd8a5445d93ea641833de0286e43f8476d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2980

C:\Users\Admin\AppData\Local\Temp\271bc266fd2420c1bce9108208c4a3bd8a5445d93ea641833de0286e43f8476d.exe
start
2⤵
PID:1504

C:\Users\Admin\AppData\Local\Temp\271bc266fd2420c1bce9108208c4a3bd8a5445d93ea641833de0286e43f8476d.exe
watch
2⤵
PID:3640

memory/1504-134-0x0000000000000000-mapping.dmp

Download
memory/1504-137-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1504-139-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1504-140-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2980-132-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2980-135-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3640-133-0x0000000000000000-mapping.dmp

Download
memory/3640-136-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3640-138-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3640-141-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download