1bb732f592dd711acc3adf23cdfa971b546062743f3401c5e6f4b22b4aeed44d

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:22

Target

1bb732f592dd711acc3adf23cdfa971b546062743f3401c5e6f4b22b4aeed44d.exe
Size

518KB
MD5

4db28656798a3b8b2247015a9c3376ec
SHA1

729bb56a1fcda08665b72b4f93cbcec069c0a598
SHA256

1bb732f592dd711acc3adf23cdfa971b546062743f3401c5e6f4b22b4aeed44d
SHA512

918fb44b2e9905729a8e5f7f94001016ff1018365d4403d3422b7f4f99aafc89ad91ed0df0bd7a4c549639e24acbde8a96b9502c2b94509bfb6a10694de9cfcf
SSDEEP

12288:AsxH6gRidnAiLx0qZxss2vivsn87wYYlLPt5oKnWq3SbC:As0qi5zLx1TsH7lLPt5/WDC

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

1bb732f592dd711acc3adf23cdfa971b546062743f3401c5e6f4b22b4aeed44d.exe

description	pid	process	target process
PID 4640 wrote to memory of 1924	4640	1bb732f592dd711acc3adf23cdfa971b546062743f3401c5e6f4b22b4aeed44d.exe	1bb732f592dd711acc3adf23cdfa971b546062743f3401c5e6f4b22b4aeed44d.exe
PID 4640 wrote to memory of 1924	4640	1bb732f592dd711acc3adf23cdfa971b546062743f3401c5e6f4b22b4aeed44d.exe	1bb732f592dd711acc3adf23cdfa971b546062743f3401c5e6f4b22b4aeed44d.exe
PID 4640 wrote to memory of 1924	4640	1bb732f592dd711acc3adf23cdfa971b546062743f3401c5e6f4b22b4aeed44d.exe	1bb732f592dd711acc3adf23cdfa971b546062743f3401c5e6f4b22b4aeed44d.exe
PID 4640 wrote to memory of 2640	4640	1bb732f592dd711acc3adf23cdfa971b546062743f3401c5e6f4b22b4aeed44d.exe	1bb732f592dd711acc3adf23cdfa971b546062743f3401c5e6f4b22b4aeed44d.exe
PID 4640 wrote to memory of 2640	4640	1bb732f592dd711acc3adf23cdfa971b546062743f3401c5e6f4b22b4aeed44d.exe	1bb732f592dd711acc3adf23cdfa971b546062743f3401c5e6f4b22b4aeed44d.exe
PID 4640 wrote to memory of 2640	4640	1bb732f592dd711acc3adf23cdfa971b546062743f3401c5e6f4b22b4aeed44d.exe	1bb732f592dd711acc3adf23cdfa971b546062743f3401c5e6f4b22b4aeed44d.exe

C:\Users\Admin\AppData\Local\Temp\1bb732f592dd711acc3adf23cdfa971b546062743f3401c5e6f4b22b4aeed44d.exe
"C:\Users\Admin\AppData\Local\Temp\1bb732f592dd711acc3adf23cdfa971b546062743f3401c5e6f4b22b4aeed44d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4640

C:\Users\Admin\AppData\Local\Temp\1bb732f592dd711acc3adf23cdfa971b546062743f3401c5e6f4b22b4aeed44d.exe
start
2⤵
PID:1924

C:\Users\Admin\AppData\Local\Temp\1bb732f592dd711acc3adf23cdfa971b546062743f3401c5e6f4b22b4aeed44d.exe
watch
2⤵
PID:2640

memory/1924-134-0x0000000000000000-mapping.dmp

Download
memory/1924-137-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1924-138-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2640-133-0x0000000000000000-mapping.dmp

Download
memory/2640-136-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2640-139-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4640-132-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4640-135-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download