0ac6b33f7c2f6966759a003ab1a42ba82fb5c0a3f780533e18998f4183b1ef32

Analysis

max time kernel
137s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:24

Target

0ac6b33f7c2f6966759a003ab1a42ba82fb5c0a3f780533e18998f4183b1ef32.exe
Size

522KB
MD5

4bb7e555ba3b48c535f38a7d9ed2fb9d
SHA1

d6a692dbf0961145fa9101de73061a2323aa4af3
SHA256

0ac6b33f7c2f6966759a003ab1a42ba82fb5c0a3f780533e18998f4183b1ef32
SHA512

dde3dc58d40a7fd54f1f96f8330b6a8218e4f9497f233eace7c563f2b970668f76afd2ca302d0aed3d8f821852799dea506f0ecdf1bc40f49106d0e8a41947c5
SSDEEP

12288:LaR+mx74Z6QnSUiVAZowjy9Y6y18xQqpx8O5P:bmSYRVaowubatqpx8

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

0ac6b33f7c2f6966759a003ab1a42ba82fb5c0a3f780533e18998f4183b1ef32.exe

description	pid	process	target process
PID 3464 wrote to memory of 5080	3464	0ac6b33f7c2f6966759a003ab1a42ba82fb5c0a3f780533e18998f4183b1ef32.exe	0ac6b33f7c2f6966759a003ab1a42ba82fb5c0a3f780533e18998f4183b1ef32.exe
PID 3464 wrote to memory of 5080	3464	0ac6b33f7c2f6966759a003ab1a42ba82fb5c0a3f780533e18998f4183b1ef32.exe	0ac6b33f7c2f6966759a003ab1a42ba82fb5c0a3f780533e18998f4183b1ef32.exe
PID 3464 wrote to memory of 5080	3464	0ac6b33f7c2f6966759a003ab1a42ba82fb5c0a3f780533e18998f4183b1ef32.exe	0ac6b33f7c2f6966759a003ab1a42ba82fb5c0a3f780533e18998f4183b1ef32.exe
PID 3464 wrote to memory of 3444	3464	0ac6b33f7c2f6966759a003ab1a42ba82fb5c0a3f780533e18998f4183b1ef32.exe	0ac6b33f7c2f6966759a003ab1a42ba82fb5c0a3f780533e18998f4183b1ef32.exe
PID 3464 wrote to memory of 3444	3464	0ac6b33f7c2f6966759a003ab1a42ba82fb5c0a3f780533e18998f4183b1ef32.exe	0ac6b33f7c2f6966759a003ab1a42ba82fb5c0a3f780533e18998f4183b1ef32.exe
PID 3464 wrote to memory of 3444	3464	0ac6b33f7c2f6966759a003ab1a42ba82fb5c0a3f780533e18998f4183b1ef32.exe	0ac6b33f7c2f6966759a003ab1a42ba82fb5c0a3f780533e18998f4183b1ef32.exe

C:\Users\Admin\AppData\Local\Temp\0ac6b33f7c2f6966759a003ab1a42ba82fb5c0a3f780533e18998f4183b1ef32.exe
"C:\Users\Admin\AppData\Local\Temp\0ac6b33f7c2f6966759a003ab1a42ba82fb5c0a3f780533e18998f4183b1ef32.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3464

C:\Users\Admin\AppData\Local\Temp\0ac6b33f7c2f6966759a003ab1a42ba82fb5c0a3f780533e18998f4183b1ef32.exe
start
2⤵
PID:5080

C:\Users\Admin\AppData\Local\Temp\0ac6b33f7c2f6966759a003ab1a42ba82fb5c0a3f780533e18998f4183b1ef32.exe
watch
2⤵
PID:3444

memory/3444-133-0x0000000000000000-mapping.dmp

Download
memory/3444-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3444-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3444-142-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3464-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3464-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/5080-134-0x0000000000000000-mapping.dmp

Download
memory/5080-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/5080-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/5080-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/5080-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download