11988e08eda0bfee7e82fe056eaf378fb508c9d49096d6dec0c72293c6b1f4e1

Analysis

max time kernel
142s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:23

Target

11988e08eda0bfee7e82fe056eaf378fb508c9d49096d6dec0c72293c6b1f4e1.exe
Size

526KB
MD5

551de27ad1994883428768918381d31c
SHA1

80badb1f6b6ef058c28adf40df83903c9eb32a38
SHA256

11988e08eda0bfee7e82fe056eaf378fb508c9d49096d6dec0c72293c6b1f4e1
SHA512

02387462313c33f411bef2410f2b5b6fe37e3737c32313197b9aa28ec950f600f3f8af13f1c70dcae6ee90237fdf2f3c37b53e1827cd4a6dfaadd373055849a2
SSDEEP

12288:ffwSdsw+gVePzwjaBIiAATfjqzt1GfoJy18xQqpx8O5Ly:3FdBIcGBIfAbMt1GKatqpx8d

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

11988e08eda0bfee7e82fe056eaf378fb508c9d49096d6dec0c72293c6b1f4e1.exe

description	pid	process	target process
PID 2620 wrote to memory of 4716	2620	11988e08eda0bfee7e82fe056eaf378fb508c9d49096d6dec0c72293c6b1f4e1.exe	11988e08eda0bfee7e82fe056eaf378fb508c9d49096d6dec0c72293c6b1f4e1.exe
PID 2620 wrote to memory of 4716	2620	11988e08eda0bfee7e82fe056eaf378fb508c9d49096d6dec0c72293c6b1f4e1.exe	11988e08eda0bfee7e82fe056eaf378fb508c9d49096d6dec0c72293c6b1f4e1.exe
PID 2620 wrote to memory of 4716	2620	11988e08eda0bfee7e82fe056eaf378fb508c9d49096d6dec0c72293c6b1f4e1.exe	11988e08eda0bfee7e82fe056eaf378fb508c9d49096d6dec0c72293c6b1f4e1.exe
PID 2620 wrote to memory of 3068	2620	11988e08eda0bfee7e82fe056eaf378fb508c9d49096d6dec0c72293c6b1f4e1.exe	11988e08eda0bfee7e82fe056eaf378fb508c9d49096d6dec0c72293c6b1f4e1.exe
PID 2620 wrote to memory of 3068	2620	11988e08eda0bfee7e82fe056eaf378fb508c9d49096d6dec0c72293c6b1f4e1.exe	11988e08eda0bfee7e82fe056eaf378fb508c9d49096d6dec0c72293c6b1f4e1.exe
PID 2620 wrote to memory of 3068	2620	11988e08eda0bfee7e82fe056eaf378fb508c9d49096d6dec0c72293c6b1f4e1.exe	11988e08eda0bfee7e82fe056eaf378fb508c9d49096d6dec0c72293c6b1f4e1.exe

C:\Users\Admin\AppData\Local\Temp\11988e08eda0bfee7e82fe056eaf378fb508c9d49096d6dec0c72293c6b1f4e1.exe
"C:\Users\Admin\AppData\Local\Temp\11988e08eda0bfee7e82fe056eaf378fb508c9d49096d6dec0c72293c6b1f4e1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2620

C:\Users\Admin\AppData\Local\Temp\11988e08eda0bfee7e82fe056eaf378fb508c9d49096d6dec0c72293c6b1f4e1.exe
start
2⤵
PID:4716

C:\Users\Admin\AppData\Local\Temp\11988e08eda0bfee7e82fe056eaf378fb508c9d49096d6dec0c72293c6b1f4e1.exe
watch
2⤵
PID:3068

memory/2620-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2620-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3068-133-0x0000000000000000-mapping.dmp

Download
memory/3068-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3068-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3068-142-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4716-134-0x0000000000000000-mapping.dmp

Download
memory/4716-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4716-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4716-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4716-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download