1cc3f13d99df397c954591dd7af1a4da0da0ebaaba733a604aeee665f7420b6c

Analysis

max time kernel
138s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:21

Target

1cc3f13d99df397c954591dd7af1a4da0da0ebaaba733a604aeee665f7420b6c.exe
Size

526KB
MD5

98c13a85d1377389e0b3791c24c2a0eb
SHA1

ad00268a865e58fae0e1121c6de6077e79831bfb
SHA256

1cc3f13d99df397c954591dd7af1a4da0da0ebaaba733a604aeee665f7420b6c
SHA512

19ef797b5e4f99a9da5ea75f3deff4b71e3053aab40aa40cd217e47b1a9d1a5e85573a8390204e7224b16183f663eb5c84fb7b6f87cf8ec55f094594eb141fa9
SSDEEP

12288:4zcooXBatd70yhjf0Q0EqiZirUh4y18xQqpx8O5SE:YtdoyNMQ0Pi8a4atqpx8y

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

1cc3f13d99df397c954591dd7af1a4da0da0ebaaba733a604aeee665f7420b6c.exe

description	pid	process	target process
PID 2820 wrote to memory of 3420	2820	1cc3f13d99df397c954591dd7af1a4da0da0ebaaba733a604aeee665f7420b6c.exe	1cc3f13d99df397c954591dd7af1a4da0da0ebaaba733a604aeee665f7420b6c.exe
PID 2820 wrote to memory of 3420	2820	1cc3f13d99df397c954591dd7af1a4da0da0ebaaba733a604aeee665f7420b6c.exe	1cc3f13d99df397c954591dd7af1a4da0da0ebaaba733a604aeee665f7420b6c.exe
PID 2820 wrote to memory of 3420	2820	1cc3f13d99df397c954591dd7af1a4da0da0ebaaba733a604aeee665f7420b6c.exe	1cc3f13d99df397c954591dd7af1a4da0da0ebaaba733a604aeee665f7420b6c.exe
PID 2820 wrote to memory of 3836	2820	1cc3f13d99df397c954591dd7af1a4da0da0ebaaba733a604aeee665f7420b6c.exe	1cc3f13d99df397c954591dd7af1a4da0da0ebaaba733a604aeee665f7420b6c.exe
PID 2820 wrote to memory of 3836	2820	1cc3f13d99df397c954591dd7af1a4da0da0ebaaba733a604aeee665f7420b6c.exe	1cc3f13d99df397c954591dd7af1a4da0da0ebaaba733a604aeee665f7420b6c.exe
PID 2820 wrote to memory of 3836	2820	1cc3f13d99df397c954591dd7af1a4da0da0ebaaba733a604aeee665f7420b6c.exe	1cc3f13d99df397c954591dd7af1a4da0da0ebaaba733a604aeee665f7420b6c.exe

C:\Users\Admin\AppData\Local\Temp\1cc3f13d99df397c954591dd7af1a4da0da0ebaaba733a604aeee665f7420b6c.exe
"C:\Users\Admin\AppData\Local\Temp\1cc3f13d99df397c954591dd7af1a4da0da0ebaaba733a604aeee665f7420b6c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2820

C:\Users\Admin\AppData\Local\Temp\1cc3f13d99df397c954591dd7af1a4da0da0ebaaba733a604aeee665f7420b6c.exe
start
2⤵
PID:3420

C:\Users\Admin\AppData\Local\Temp\1cc3f13d99df397c954591dd7af1a4da0da0ebaaba733a604aeee665f7420b6c.exe
watch
2⤵
PID:3836

memory/2820-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2820-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3420-134-0x0000000000000000-mapping.dmp

Download
memory/3420-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3420-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3420-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3836-133-0x0000000000000000-mapping.dmp

Download
memory/3836-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3836-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3836-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download