2235ede2dc93941f815d6910ac4b771d500905e30c3a271964e2f3bc77d529a0

Analysis

max time kernel
170s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:21

Target

2235ede2dc93941f815d6910ac4b771d500905e30c3a271964e2f3bc77d529a0.exe
Size

522KB
MD5

a8a550ed2496d5bf769d0ddeed94abcc
SHA1

046753ce3216b16dd26f79d5bf2e418f67f1ae41
SHA256

2235ede2dc93941f815d6910ac4b771d500905e30c3a271964e2f3bc77d529a0
SHA512

f95e48bb0a9ad4d5cc5b12a330104258ec2ee58295587c9a6da23b0e3265cb6d3e49221588106fe885c301b773c7368ecf3661a309a8cef50bfc10c699338b42
SSDEEP

12288:n93a9nL1w0McoAh7gf37XBr0ZHLwYYlLPt5oKnWq33bg:nqMzAevLBAQlLPt5/Weg

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

2235ede2dc93941f815d6910ac4b771d500905e30c3a271964e2f3bc77d529a0.exe

description	pid	process	target process
PID 3052 wrote to memory of 1940	3052	2235ede2dc93941f815d6910ac4b771d500905e30c3a271964e2f3bc77d529a0.exe	2235ede2dc93941f815d6910ac4b771d500905e30c3a271964e2f3bc77d529a0.exe
PID 3052 wrote to memory of 1940	3052	2235ede2dc93941f815d6910ac4b771d500905e30c3a271964e2f3bc77d529a0.exe	2235ede2dc93941f815d6910ac4b771d500905e30c3a271964e2f3bc77d529a0.exe
PID 3052 wrote to memory of 1940	3052	2235ede2dc93941f815d6910ac4b771d500905e30c3a271964e2f3bc77d529a0.exe	2235ede2dc93941f815d6910ac4b771d500905e30c3a271964e2f3bc77d529a0.exe
PID 3052 wrote to memory of 1060	3052	2235ede2dc93941f815d6910ac4b771d500905e30c3a271964e2f3bc77d529a0.exe	2235ede2dc93941f815d6910ac4b771d500905e30c3a271964e2f3bc77d529a0.exe
PID 3052 wrote to memory of 1060	3052	2235ede2dc93941f815d6910ac4b771d500905e30c3a271964e2f3bc77d529a0.exe	2235ede2dc93941f815d6910ac4b771d500905e30c3a271964e2f3bc77d529a0.exe
PID 3052 wrote to memory of 1060	3052	2235ede2dc93941f815d6910ac4b771d500905e30c3a271964e2f3bc77d529a0.exe	2235ede2dc93941f815d6910ac4b771d500905e30c3a271964e2f3bc77d529a0.exe

C:\Users\Admin\AppData\Local\Temp\2235ede2dc93941f815d6910ac4b771d500905e30c3a271964e2f3bc77d529a0.exe
"C:\Users\Admin\AppData\Local\Temp\2235ede2dc93941f815d6910ac4b771d500905e30c3a271964e2f3bc77d529a0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3052

C:\Users\Admin\AppData\Local\Temp\2235ede2dc93941f815d6910ac4b771d500905e30c3a271964e2f3bc77d529a0.exe
start
2⤵
PID:1940

C:\Users\Admin\AppData\Local\Temp\2235ede2dc93941f815d6910ac4b771d500905e30c3a271964e2f3bc77d529a0.exe
watch
2⤵
PID:1060

memory/1060-133-0x0000000000000000-mapping.dmp

Download
memory/1060-136-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1060-138-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1060-140-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1060-143-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1940-134-0x0000000000000000-mapping.dmp

Download
memory/1940-137-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1940-139-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1940-141-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1940-142-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3052-132-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3052-135-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download