29c7bb962f2381cc5e3004764d81d4d10ca41e75a28b4359fa30da6f3cc1bd2e

Analysis

max time kernel
112s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:19

Target

29c7bb962f2381cc5e3004764d81d4d10ca41e75a28b4359fa30da6f3cc1bd2e.exe
Size

522KB
MD5

c166d81a7b7bed28b3d83e48ad7a1d52
SHA1

cc77f704b6423407a40089cee6090aaadb62d9f6
SHA256

29c7bb962f2381cc5e3004764d81d4d10ca41e75a28b4359fa30da6f3cc1bd2e
SHA512

6c07f8a39c9afd232f1e30ae5886e5431cec8ba95262f35a1cdf850d8b3c0452c8aee585c9d9c5a37233de06bfd2364b04b26874831b4b902ed498c6a08b4496
SSDEEP

12288:mBAm7K4FAPEiynM9bXd18kXy18xQqpx8O5X:gAm712PwnwbbXatqpx8

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

29c7bb962f2381cc5e3004764d81d4d10ca41e75a28b4359fa30da6f3cc1bd2e.exe

description	pid	process	target process
PID 4436 wrote to memory of 644	4436	29c7bb962f2381cc5e3004764d81d4d10ca41e75a28b4359fa30da6f3cc1bd2e.exe	29c7bb962f2381cc5e3004764d81d4d10ca41e75a28b4359fa30da6f3cc1bd2e.exe
PID 4436 wrote to memory of 644	4436	29c7bb962f2381cc5e3004764d81d4d10ca41e75a28b4359fa30da6f3cc1bd2e.exe	29c7bb962f2381cc5e3004764d81d4d10ca41e75a28b4359fa30da6f3cc1bd2e.exe
PID 4436 wrote to memory of 644	4436	29c7bb962f2381cc5e3004764d81d4d10ca41e75a28b4359fa30da6f3cc1bd2e.exe	29c7bb962f2381cc5e3004764d81d4d10ca41e75a28b4359fa30da6f3cc1bd2e.exe
PID 4436 wrote to memory of 1016	4436	29c7bb962f2381cc5e3004764d81d4d10ca41e75a28b4359fa30da6f3cc1bd2e.exe	29c7bb962f2381cc5e3004764d81d4d10ca41e75a28b4359fa30da6f3cc1bd2e.exe
PID 4436 wrote to memory of 1016	4436	29c7bb962f2381cc5e3004764d81d4d10ca41e75a28b4359fa30da6f3cc1bd2e.exe	29c7bb962f2381cc5e3004764d81d4d10ca41e75a28b4359fa30da6f3cc1bd2e.exe
PID 4436 wrote to memory of 1016	4436	29c7bb962f2381cc5e3004764d81d4d10ca41e75a28b4359fa30da6f3cc1bd2e.exe	29c7bb962f2381cc5e3004764d81d4d10ca41e75a28b4359fa30da6f3cc1bd2e.exe

C:\Users\Admin\AppData\Local\Temp\29c7bb962f2381cc5e3004764d81d4d10ca41e75a28b4359fa30da6f3cc1bd2e.exe
"C:\Users\Admin\AppData\Local\Temp\29c7bb962f2381cc5e3004764d81d4d10ca41e75a28b4359fa30da6f3cc1bd2e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4436

C:\Users\Admin\AppData\Local\Temp\29c7bb962f2381cc5e3004764d81d4d10ca41e75a28b4359fa30da6f3cc1bd2e.exe
start
2⤵
PID:644

C:\Users\Admin\AppData\Local\Temp\29c7bb962f2381cc5e3004764d81d4d10ca41e75a28b4359fa30da6f3cc1bd2e.exe
watch
2⤵
PID:1016

memory/644-134-0x0000000000000000-mapping.dmp

Download
memory/644-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/644-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/644-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/644-142-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1016-133-0x0000000000000000-mapping.dmp

Download
memory/1016-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1016-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1016-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1016-143-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4436-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4436-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download