2374b42255a6c005f5c664d67ca5b4bade7173e2130e85a66f4dba49525193d4

Analysis

max time kernel
200s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:21

Target

2374b42255a6c005f5c664d67ca5b4bade7173e2130e85a66f4dba49525193d4.exe
Size

522KB
MD5

c1904523bc4c337202c9323f927c8e18
SHA1

04dbfdb24363aa519d5e06c7fc0853096145cabe
SHA256

2374b42255a6c005f5c664d67ca5b4bade7173e2130e85a66f4dba49525193d4
SHA512

d3248a653042634397a4ecd6b47624cd686b09297cbdceca19abb2379cc3be829545951ab81c248766c5d8fc7a17ea2bfb34c670d97920e13b6d967dea21685f
SSDEEP

12288:C3gB91H0r+Tp8rEDPSaZuryy18xQqpx8O5Cn:CQ6r0HDPdZFatqpx8t

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

2374b42255a6c005f5c664d67ca5b4bade7173e2130e85a66f4dba49525193d4.exe

description	pid	process	target process
PID 1964 wrote to memory of 3324	1964	2374b42255a6c005f5c664d67ca5b4bade7173e2130e85a66f4dba49525193d4.exe	2374b42255a6c005f5c664d67ca5b4bade7173e2130e85a66f4dba49525193d4.exe
PID 1964 wrote to memory of 3324	1964	2374b42255a6c005f5c664d67ca5b4bade7173e2130e85a66f4dba49525193d4.exe	2374b42255a6c005f5c664d67ca5b4bade7173e2130e85a66f4dba49525193d4.exe
PID 1964 wrote to memory of 3324	1964	2374b42255a6c005f5c664d67ca5b4bade7173e2130e85a66f4dba49525193d4.exe	2374b42255a6c005f5c664d67ca5b4bade7173e2130e85a66f4dba49525193d4.exe
PID 1964 wrote to memory of 3056	1964	2374b42255a6c005f5c664d67ca5b4bade7173e2130e85a66f4dba49525193d4.exe	2374b42255a6c005f5c664d67ca5b4bade7173e2130e85a66f4dba49525193d4.exe
PID 1964 wrote to memory of 3056	1964	2374b42255a6c005f5c664d67ca5b4bade7173e2130e85a66f4dba49525193d4.exe	2374b42255a6c005f5c664d67ca5b4bade7173e2130e85a66f4dba49525193d4.exe
PID 1964 wrote to memory of 3056	1964	2374b42255a6c005f5c664d67ca5b4bade7173e2130e85a66f4dba49525193d4.exe	2374b42255a6c005f5c664d67ca5b4bade7173e2130e85a66f4dba49525193d4.exe

C:\Users\Admin\AppData\Local\Temp\2374b42255a6c005f5c664d67ca5b4bade7173e2130e85a66f4dba49525193d4.exe
"C:\Users\Admin\AppData\Local\Temp\2374b42255a6c005f5c664d67ca5b4bade7173e2130e85a66f4dba49525193d4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1964

C:\Users\Admin\AppData\Local\Temp\2374b42255a6c005f5c664d67ca5b4bade7173e2130e85a66f4dba49525193d4.exe
start
2⤵
PID:3324

C:\Users\Admin\AppData\Local\Temp\2374b42255a6c005f5c664d67ca5b4bade7173e2130e85a66f4dba49525193d4.exe
watch
2⤵
PID:3056

memory/1964-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1964-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3056-133-0x0000000000000000-mapping.dmp

Download
memory/3056-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3056-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3056-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3056-143-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3324-134-0x0000000000000000-mapping.dmp

Download
memory/3324-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3324-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3324-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3324-142-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download