1dc81b69801cb046f46ab39e23366993e9b1c9a57e99ac31590102a594fab6d5

Analysis

max time kernel
253s
max time network
292s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:21

Target

1dc81b69801cb046f46ab39e23366993e9b1c9a57e99ac31590102a594fab6d5.exe
Size

526KB
MD5

2b1aac4e9968265802a6f81d2bf01aad
SHA1

279f2d33541a4d0b8fac83cd4422ee828ebe0971
SHA256

1dc81b69801cb046f46ab39e23366993e9b1c9a57e99ac31590102a594fab6d5
SHA512

21bf42e546751777c920d83b60b40379a8ce8a91fa7d6636c6829333158ec742be67132846560f3fda050918bd23823782dc2eccfa1b3fe2d4211f95f81229b5
SSDEEP

6144:M/PlRmIIy5e3BfjRDheyEMc3jXknLedkUv7uUgmgzmUjmQy1CrxQqD9RSaSz+8Or:6tAffeyiILQgx7y18xQqpx8O5ZX

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

1dc81b69801cb046f46ab39e23366993e9b1c9a57e99ac31590102a594fab6d5.exe

description	pid	process	target process
PID 4920 wrote to memory of 1252	4920	1dc81b69801cb046f46ab39e23366993e9b1c9a57e99ac31590102a594fab6d5.exe	1dc81b69801cb046f46ab39e23366993e9b1c9a57e99ac31590102a594fab6d5.exe
PID 4920 wrote to memory of 1252	4920	1dc81b69801cb046f46ab39e23366993e9b1c9a57e99ac31590102a594fab6d5.exe	1dc81b69801cb046f46ab39e23366993e9b1c9a57e99ac31590102a594fab6d5.exe
PID 4920 wrote to memory of 1252	4920	1dc81b69801cb046f46ab39e23366993e9b1c9a57e99ac31590102a594fab6d5.exe	1dc81b69801cb046f46ab39e23366993e9b1c9a57e99ac31590102a594fab6d5.exe
PID 4920 wrote to memory of 4316	4920	1dc81b69801cb046f46ab39e23366993e9b1c9a57e99ac31590102a594fab6d5.exe	1dc81b69801cb046f46ab39e23366993e9b1c9a57e99ac31590102a594fab6d5.exe
PID 4920 wrote to memory of 4316	4920	1dc81b69801cb046f46ab39e23366993e9b1c9a57e99ac31590102a594fab6d5.exe	1dc81b69801cb046f46ab39e23366993e9b1c9a57e99ac31590102a594fab6d5.exe
PID 4920 wrote to memory of 4316	4920	1dc81b69801cb046f46ab39e23366993e9b1c9a57e99ac31590102a594fab6d5.exe	1dc81b69801cb046f46ab39e23366993e9b1c9a57e99ac31590102a594fab6d5.exe

C:\Users\Admin\AppData\Local\Temp\1dc81b69801cb046f46ab39e23366993e9b1c9a57e99ac31590102a594fab6d5.exe
"C:\Users\Admin\AppData\Local\Temp\1dc81b69801cb046f46ab39e23366993e9b1c9a57e99ac31590102a594fab6d5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4920

C:\Users\Admin\AppData\Local\Temp\1dc81b69801cb046f46ab39e23366993e9b1c9a57e99ac31590102a594fab6d5.exe
start
2⤵
PID:1252

C:\Users\Admin\AppData\Local\Temp\1dc81b69801cb046f46ab39e23366993e9b1c9a57e99ac31590102a594fab6d5.exe
watch
2⤵
PID:4316

memory/1252-135-0x0000000000000000-mapping.dmp

Download
memory/1252-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1252-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1252-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4316-134-0x0000000000000000-mapping.dmp

Download
memory/4316-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4316-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4316-142-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4920-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4920-133-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4920-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download