2cea1369408bf0097b5370a431b6a0ccff174fb9790da657aa2965140736fdf7

Analysis

max time kernel
171s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:19

Target

2cea1369408bf0097b5370a431b6a0ccff174fb9790da657aa2965140736fdf7.exe
Size

518KB
MD5

d9a5b683208c0a8b91b99d55e9ffde81
SHA1

dbd5934ba75b6e65ca7ff63c29aae082bf8b2d3f
SHA256

2cea1369408bf0097b5370a431b6a0ccff174fb9790da657aa2965140736fdf7
SHA512

be2ea1d995e2cdcd752da64bbdcb3ae75801ad2388f60516a5203b5ee41830c6e067ddebb74918761937d08d678b9f16c2b29bf2ba59b929c3eb75529ea64836
SSDEEP

6144:BuqsVrsJ/hM8JQEvUgdoUmbpyJ0enVClSPPU7Oclw75G9+lLPX9MM8e459KOoWqu:BT9ftDVzy0VaSrcwYYlLPt5oKnWq3ub

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

2cea1369408bf0097b5370a431b6a0ccff174fb9790da657aa2965140736fdf7.exe

description	pid	process	target process
PID 4404 wrote to memory of 1176	4404	2cea1369408bf0097b5370a431b6a0ccff174fb9790da657aa2965140736fdf7.exe	2cea1369408bf0097b5370a431b6a0ccff174fb9790da657aa2965140736fdf7.exe
PID 4404 wrote to memory of 1176	4404	2cea1369408bf0097b5370a431b6a0ccff174fb9790da657aa2965140736fdf7.exe	2cea1369408bf0097b5370a431b6a0ccff174fb9790da657aa2965140736fdf7.exe
PID 4404 wrote to memory of 1176	4404	2cea1369408bf0097b5370a431b6a0ccff174fb9790da657aa2965140736fdf7.exe	2cea1369408bf0097b5370a431b6a0ccff174fb9790da657aa2965140736fdf7.exe
PID 4404 wrote to memory of 4828	4404	2cea1369408bf0097b5370a431b6a0ccff174fb9790da657aa2965140736fdf7.exe	2cea1369408bf0097b5370a431b6a0ccff174fb9790da657aa2965140736fdf7.exe
PID 4404 wrote to memory of 4828	4404	2cea1369408bf0097b5370a431b6a0ccff174fb9790da657aa2965140736fdf7.exe	2cea1369408bf0097b5370a431b6a0ccff174fb9790da657aa2965140736fdf7.exe
PID 4404 wrote to memory of 4828	4404	2cea1369408bf0097b5370a431b6a0ccff174fb9790da657aa2965140736fdf7.exe	2cea1369408bf0097b5370a431b6a0ccff174fb9790da657aa2965140736fdf7.exe

C:\Users\Admin\AppData\Local\Temp\2cea1369408bf0097b5370a431b6a0ccff174fb9790da657aa2965140736fdf7.exe
"C:\Users\Admin\AppData\Local\Temp\2cea1369408bf0097b5370a431b6a0ccff174fb9790da657aa2965140736fdf7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4404

C:\Users\Admin\AppData\Local\Temp\2cea1369408bf0097b5370a431b6a0ccff174fb9790da657aa2965140736fdf7.exe
start
2⤵
PID:1176

C:\Users\Admin\AppData\Local\Temp\2cea1369408bf0097b5370a431b6a0ccff174fb9790da657aa2965140736fdf7.exe
watch
2⤵
PID:4828

memory/1176-134-0x0000000000000000-mapping.dmp

Download
memory/1176-137-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1176-139-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1176-141-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1176-142-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4404-132-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4404-135-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4828-133-0x0000000000000000-mapping.dmp

Download
memory/4828-136-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4828-138-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4828-140-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4828-143-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download