84cad07a2a7c05a0544f532d04f16eb051d99810832c2d21655e9798f9114064

Analysis

max time kernel
91s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:48

Target

84cad07a2a7c05a0544f532d04f16eb051d99810832c2d21655e9798f9114064.exe
Size

522KB
MD5

66b06670fc9a70d3338f62789316b083
SHA1

e97c1f6f35c56505e435963ae92def93b8957bf2
SHA256

84cad07a2a7c05a0544f532d04f16eb051d99810832c2d21655e9798f9114064
SHA512

533b3aeddb0fdcddfc2cab9ce8945a85d7a16859a2a77d6526755f5e578d4a52e8ab59ffb63f0839f6be199bdfbe4ede00f427ea87c16605833eabd341a05e82
SSDEEP

12288:E036JLvTdtwheu7me2EOPy18xQqpx8O5XM:E036JLvBtKeqyE0atqpx8v

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

84cad07a2a7c05a0544f532d04f16eb051d99810832c2d21655e9798f9114064.exe

description	pid	process	target process
PID 4032 wrote to memory of 1124	4032	84cad07a2a7c05a0544f532d04f16eb051d99810832c2d21655e9798f9114064.exe	84cad07a2a7c05a0544f532d04f16eb051d99810832c2d21655e9798f9114064.exe
PID 4032 wrote to memory of 1124	4032	84cad07a2a7c05a0544f532d04f16eb051d99810832c2d21655e9798f9114064.exe	84cad07a2a7c05a0544f532d04f16eb051d99810832c2d21655e9798f9114064.exe
PID 4032 wrote to memory of 1124	4032	84cad07a2a7c05a0544f532d04f16eb051d99810832c2d21655e9798f9114064.exe	84cad07a2a7c05a0544f532d04f16eb051d99810832c2d21655e9798f9114064.exe
PID 4032 wrote to memory of 3120	4032	84cad07a2a7c05a0544f532d04f16eb051d99810832c2d21655e9798f9114064.exe	84cad07a2a7c05a0544f532d04f16eb051d99810832c2d21655e9798f9114064.exe
PID 4032 wrote to memory of 3120	4032	84cad07a2a7c05a0544f532d04f16eb051d99810832c2d21655e9798f9114064.exe	84cad07a2a7c05a0544f532d04f16eb051d99810832c2d21655e9798f9114064.exe
PID 4032 wrote to memory of 3120	4032	84cad07a2a7c05a0544f532d04f16eb051d99810832c2d21655e9798f9114064.exe	84cad07a2a7c05a0544f532d04f16eb051d99810832c2d21655e9798f9114064.exe

C:\Users\Admin\AppData\Local\Temp\84cad07a2a7c05a0544f532d04f16eb051d99810832c2d21655e9798f9114064.exe
"C:\Users\Admin\AppData\Local\Temp\84cad07a2a7c05a0544f532d04f16eb051d99810832c2d21655e9798f9114064.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4032

C:\Users\Admin\AppData\Local\Temp\84cad07a2a7c05a0544f532d04f16eb051d99810832c2d21655e9798f9114064.exe
start
2⤵
PID:1124

C:\Users\Admin\AppData\Local\Temp\84cad07a2a7c05a0544f532d04f16eb051d99810832c2d21655e9798f9114064.exe
watch
2⤵
PID:3120

memory/1124-134-0x0000000000000000-mapping.dmp

Download
memory/1124-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1124-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1124-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3120-133-0x0000000000000000-mapping.dmp

Download
memory/3120-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3120-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3120-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4032-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4032-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download