1ac1a7ac10ef71716e35467025ea2d006f9fa7a98f8deafc2832e9795ede3a91

Analysis

max time kernel
150s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:22

Target

1ac1a7ac10ef71716e35467025ea2d006f9fa7a98f8deafc2832e9795ede3a91.exe
Size

518KB
MD5

54c67cf1ec761a65ac8aeece5908d13e
SHA1

2ba0dfa201843dce642cb2a489c92f22407472f5
SHA256

1ac1a7ac10ef71716e35467025ea2d006f9fa7a98f8deafc2832e9795ede3a91
SHA512

baf0d80073dd8ef4d7f8774d9580db9e801c6f1964274443f7741eb36b97c9eaf96d4d006e3d36d30d404fd1be5ea788fd97630fbc4a8912b72b28f131e35e10
SSDEEP

12288:DkdomfAyachVdCiKnaawYYlLPt5oKnWq3Bb:DkdqyDXrKnUlLPt5/Wc

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

1ac1a7ac10ef71716e35467025ea2d006f9fa7a98f8deafc2832e9795ede3a91.exe

description	pid	process	target process
PID 5000 wrote to memory of 4932	5000	1ac1a7ac10ef71716e35467025ea2d006f9fa7a98f8deafc2832e9795ede3a91.exe	1ac1a7ac10ef71716e35467025ea2d006f9fa7a98f8deafc2832e9795ede3a91.exe
PID 5000 wrote to memory of 4932	5000	1ac1a7ac10ef71716e35467025ea2d006f9fa7a98f8deafc2832e9795ede3a91.exe	1ac1a7ac10ef71716e35467025ea2d006f9fa7a98f8deafc2832e9795ede3a91.exe
PID 5000 wrote to memory of 4932	5000	1ac1a7ac10ef71716e35467025ea2d006f9fa7a98f8deafc2832e9795ede3a91.exe	1ac1a7ac10ef71716e35467025ea2d006f9fa7a98f8deafc2832e9795ede3a91.exe
PID 5000 wrote to memory of 1532	5000	1ac1a7ac10ef71716e35467025ea2d006f9fa7a98f8deafc2832e9795ede3a91.exe	1ac1a7ac10ef71716e35467025ea2d006f9fa7a98f8deafc2832e9795ede3a91.exe
PID 5000 wrote to memory of 1532	5000	1ac1a7ac10ef71716e35467025ea2d006f9fa7a98f8deafc2832e9795ede3a91.exe	1ac1a7ac10ef71716e35467025ea2d006f9fa7a98f8deafc2832e9795ede3a91.exe
PID 5000 wrote to memory of 1532	5000	1ac1a7ac10ef71716e35467025ea2d006f9fa7a98f8deafc2832e9795ede3a91.exe	1ac1a7ac10ef71716e35467025ea2d006f9fa7a98f8deafc2832e9795ede3a91.exe

C:\Users\Admin\AppData\Local\Temp\1ac1a7ac10ef71716e35467025ea2d006f9fa7a98f8deafc2832e9795ede3a91.exe
"C:\Users\Admin\AppData\Local\Temp\1ac1a7ac10ef71716e35467025ea2d006f9fa7a98f8deafc2832e9795ede3a91.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5000

C:\Users\Admin\AppData\Local\Temp\1ac1a7ac10ef71716e35467025ea2d006f9fa7a98f8deafc2832e9795ede3a91.exe
start
2⤵
PID:4932

C:\Users\Admin\AppData\Local\Temp\1ac1a7ac10ef71716e35467025ea2d006f9fa7a98f8deafc2832e9795ede3a91.exe
watch
2⤵
PID:1532

memory/1532-133-0x0000000000000000-mapping.dmp

Download
memory/1532-137-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1532-139-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4932-134-0x0000000000000000-mapping.dmp

Download
memory/4932-136-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4932-138-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/5000-132-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/5000-135-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download