848af05a0f2fa1c4cb10038990d0779b89173d061cc7da0e3dd7241b63435b28

Analysis

max time kernel
92s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:48

Target

848af05a0f2fa1c4cb10038990d0779b89173d061cc7da0e3dd7241b63435b28.exe
Size

521KB
MD5

205541ad2a079552eaa6d4b6d9b4def3
SHA1

ffcdcdf04b2302feb0df6dd214a6443aa60e8284
SHA256

848af05a0f2fa1c4cb10038990d0779b89173d061cc7da0e3dd7241b63435b28
SHA512

e0fead74d56b4ffb73f714818e2b4244c0cc6c02977c658f9eeeb6e92669cc42d217174072f0ec1965908fe0df565879c3e721ebf93b61d1bb9e8eb3fa959a43
SSDEEP

6144:RDXdcyPpJP03nn4tIESNdhQyBgRdV93AHI/tPuKEaUf1Xv3Sg8Gf8yRtD3iBeJQ0:RDRJP0Xfc/dVKKqfgGexGWRLUZ

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

848af05a0f2fa1c4cb10038990d0779b89173d061cc7da0e3dd7241b63435b28.exe

description	pid	process	target process
PID 1400 wrote to memory of 4440	1400	848af05a0f2fa1c4cb10038990d0779b89173d061cc7da0e3dd7241b63435b28.exe	848af05a0f2fa1c4cb10038990d0779b89173d061cc7da0e3dd7241b63435b28.exe
PID 1400 wrote to memory of 4440	1400	848af05a0f2fa1c4cb10038990d0779b89173d061cc7da0e3dd7241b63435b28.exe	848af05a0f2fa1c4cb10038990d0779b89173d061cc7da0e3dd7241b63435b28.exe
PID 1400 wrote to memory of 4440	1400	848af05a0f2fa1c4cb10038990d0779b89173d061cc7da0e3dd7241b63435b28.exe	848af05a0f2fa1c4cb10038990d0779b89173d061cc7da0e3dd7241b63435b28.exe
PID 1400 wrote to memory of 1016	1400	848af05a0f2fa1c4cb10038990d0779b89173d061cc7da0e3dd7241b63435b28.exe	848af05a0f2fa1c4cb10038990d0779b89173d061cc7da0e3dd7241b63435b28.exe
PID 1400 wrote to memory of 1016	1400	848af05a0f2fa1c4cb10038990d0779b89173d061cc7da0e3dd7241b63435b28.exe	848af05a0f2fa1c4cb10038990d0779b89173d061cc7da0e3dd7241b63435b28.exe
PID 1400 wrote to memory of 1016	1400	848af05a0f2fa1c4cb10038990d0779b89173d061cc7da0e3dd7241b63435b28.exe	848af05a0f2fa1c4cb10038990d0779b89173d061cc7da0e3dd7241b63435b28.exe

C:\Users\Admin\AppData\Local\Temp\848af05a0f2fa1c4cb10038990d0779b89173d061cc7da0e3dd7241b63435b28.exe
"C:\Users\Admin\AppData\Local\Temp\848af05a0f2fa1c4cb10038990d0779b89173d061cc7da0e3dd7241b63435b28.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1400

C:\Users\Admin\AppData\Local\Temp\848af05a0f2fa1c4cb10038990d0779b89173d061cc7da0e3dd7241b63435b28.exe
start
2⤵
PID:4440

C:\Users\Admin\AppData\Local\Temp\848af05a0f2fa1c4cb10038990d0779b89173d061cc7da0e3dd7241b63435b28.exe
watch
2⤵
PID:1016

memory/1016-133-0x0000000000000000-mapping.dmp

Download
memory/1016-136-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1016-139-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1016-140-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1400-132-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1400-135-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4440-134-0x0000000000000000-mapping.dmp

Download
memory/4440-137-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4440-138-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download