89e6af26ab4580d1592ae34422b5ca98e6baba4bfd3a142ab677a9fcec33acaf

Analysis

max time kernel
197s
max time network
237s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:44

Target

89e6af26ab4580d1592ae34422b5ca98e6baba4bfd3a142ab677a9fcec33acaf.exe
Size

522KB
MD5

3d777a7994f10fec029ab80cba60de64
SHA1

c48f90f24633ecbf94a2184a22e896d58a6a82da
SHA256

89e6af26ab4580d1592ae34422b5ca98e6baba4bfd3a142ab677a9fcec33acaf
SHA512

af4e9e283b5db2ab1acf74874f6c167c987530fc0dacb3a2526c7284277b70dab05b4fd95022448f032be28e80c236235a22dea3137625414c6bb58b3a0dc201
SSDEEP

12288:5qDvG+S8lxe1FbVZNxPI7o9y18xQqpx8O5L/:5qDvG+DubVzdIk9atqpx8E

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

89e6af26ab4580d1592ae34422b5ca98e6baba4bfd3a142ab677a9fcec33acaf.exe

description	pid	process	target process
PID 4284 wrote to memory of 2408	4284	89e6af26ab4580d1592ae34422b5ca98e6baba4bfd3a142ab677a9fcec33acaf.exe	89e6af26ab4580d1592ae34422b5ca98e6baba4bfd3a142ab677a9fcec33acaf.exe
PID 4284 wrote to memory of 2408	4284	89e6af26ab4580d1592ae34422b5ca98e6baba4bfd3a142ab677a9fcec33acaf.exe	89e6af26ab4580d1592ae34422b5ca98e6baba4bfd3a142ab677a9fcec33acaf.exe
PID 4284 wrote to memory of 2408	4284	89e6af26ab4580d1592ae34422b5ca98e6baba4bfd3a142ab677a9fcec33acaf.exe	89e6af26ab4580d1592ae34422b5ca98e6baba4bfd3a142ab677a9fcec33acaf.exe
PID 4284 wrote to memory of 2356	4284	89e6af26ab4580d1592ae34422b5ca98e6baba4bfd3a142ab677a9fcec33acaf.exe	89e6af26ab4580d1592ae34422b5ca98e6baba4bfd3a142ab677a9fcec33acaf.exe
PID 4284 wrote to memory of 2356	4284	89e6af26ab4580d1592ae34422b5ca98e6baba4bfd3a142ab677a9fcec33acaf.exe	89e6af26ab4580d1592ae34422b5ca98e6baba4bfd3a142ab677a9fcec33acaf.exe
PID 4284 wrote to memory of 2356	4284	89e6af26ab4580d1592ae34422b5ca98e6baba4bfd3a142ab677a9fcec33acaf.exe	89e6af26ab4580d1592ae34422b5ca98e6baba4bfd3a142ab677a9fcec33acaf.exe

C:\Users\Admin\AppData\Local\Temp\89e6af26ab4580d1592ae34422b5ca98e6baba4bfd3a142ab677a9fcec33acaf.exe
"C:\Users\Admin\AppData\Local\Temp\89e6af26ab4580d1592ae34422b5ca98e6baba4bfd3a142ab677a9fcec33acaf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4284

C:\Users\Admin\AppData\Local\Temp\89e6af26ab4580d1592ae34422b5ca98e6baba4bfd3a142ab677a9fcec33acaf.exe
start
2⤵
PID:2408

C:\Users\Admin\AppData\Local\Temp\89e6af26ab4580d1592ae34422b5ca98e6baba4bfd3a142ab677a9fcec33acaf.exe
watch
2⤵
PID:2356

memory/2356-133-0x0000000000000000-mapping.dmp

Download
memory/2356-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2356-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2356-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2356-143-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2408-134-0x0000000000000000-mapping.dmp

Download
memory/2408-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2408-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2408-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2408-142-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4284-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4284-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download