2aea767554c2c8e82e392f319a1bc91fe822311d520c813ee0f26d240c2b1ff1

Analysis

max time kernel
180s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:19

Target

2aea767554c2c8e82e392f319a1bc91fe822311d520c813ee0f26d240c2b1ff1.exe
Size

522KB
MD5

2e61d09595fe0c07bd787024fabc4dfd
SHA1

efae941bf258420afb02f66e46e464166148d1af
SHA256

2aea767554c2c8e82e392f319a1bc91fe822311d520c813ee0f26d240c2b1ff1
SHA512

4c5608b11281dfa0469ff32f37f72f173c452e4139de45896e80e27dd5db01e737ed1423a6d1fa7540a1c6c36cec920658b92e233c4b63ce5ad5b6d520384a6e
SSDEEP

6144:JOVcr9GjCjR6UcUm0DUHh4QxSI+2s4CP4iij4mQy1CrxQqD9RSaSz+8O52VQE:IIMS6FR0e6QFsbWj0y18xQqpx8O52

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

2aea767554c2c8e82e392f319a1bc91fe822311d520c813ee0f26d240c2b1ff1.exe

description	pid	process	target process
PID 400 wrote to memory of 1292	400	2aea767554c2c8e82e392f319a1bc91fe822311d520c813ee0f26d240c2b1ff1.exe	2aea767554c2c8e82e392f319a1bc91fe822311d520c813ee0f26d240c2b1ff1.exe
PID 400 wrote to memory of 1292	400	2aea767554c2c8e82e392f319a1bc91fe822311d520c813ee0f26d240c2b1ff1.exe	2aea767554c2c8e82e392f319a1bc91fe822311d520c813ee0f26d240c2b1ff1.exe
PID 400 wrote to memory of 1292	400	2aea767554c2c8e82e392f319a1bc91fe822311d520c813ee0f26d240c2b1ff1.exe	2aea767554c2c8e82e392f319a1bc91fe822311d520c813ee0f26d240c2b1ff1.exe
PID 400 wrote to memory of 668	400	2aea767554c2c8e82e392f319a1bc91fe822311d520c813ee0f26d240c2b1ff1.exe	2aea767554c2c8e82e392f319a1bc91fe822311d520c813ee0f26d240c2b1ff1.exe
PID 400 wrote to memory of 668	400	2aea767554c2c8e82e392f319a1bc91fe822311d520c813ee0f26d240c2b1ff1.exe	2aea767554c2c8e82e392f319a1bc91fe822311d520c813ee0f26d240c2b1ff1.exe
PID 400 wrote to memory of 668	400	2aea767554c2c8e82e392f319a1bc91fe822311d520c813ee0f26d240c2b1ff1.exe	2aea767554c2c8e82e392f319a1bc91fe822311d520c813ee0f26d240c2b1ff1.exe

C:\Users\Admin\AppData\Local\Temp\2aea767554c2c8e82e392f319a1bc91fe822311d520c813ee0f26d240c2b1ff1.exe
"C:\Users\Admin\AppData\Local\Temp\2aea767554c2c8e82e392f319a1bc91fe822311d520c813ee0f26d240c2b1ff1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:400

C:\Users\Admin\AppData\Local\Temp\2aea767554c2c8e82e392f319a1bc91fe822311d520c813ee0f26d240c2b1ff1.exe
start
2⤵
PID:1292

C:\Users\Admin\AppData\Local\Temp\2aea767554c2c8e82e392f319a1bc91fe822311d520c813ee0f26d240c2b1ff1.exe
watch
2⤵
PID:668

memory/400-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/400-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/668-133-0x0000000000000000-mapping.dmp

Download
memory/668-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/668-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/668-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/668-142-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1292-134-0x0000000000000000-mapping.dmp

Download
memory/1292-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1292-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1292-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download