cffe1bd1ee6f62dbf92b5ef86f0f7098bc7b301b37bec1b0e6b2d24051184232

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:03

Target

cffe1bd1ee6f62dbf92b5ef86f0f7098bc7b301b37bec1b0e6b2d24051184232.exe
Size

522KB
MD5

cfa884acaeae46492ac9eac40a62dc75
SHA1

a7be7100174f12ccd6bb7465bfd72b6318675220
SHA256

cffe1bd1ee6f62dbf92b5ef86f0f7098bc7b301b37bec1b0e6b2d24051184232
SHA512

d1e786da437d0d0d61d082975bb8e6b31a6209fae086ad01cc0b3f9d747c99f61cb740e001a23e1d4c6a7833a3205f4db6d6c043ce8ad9db3059a228ecf42113
SSDEEP

6144:qx0Hkq2AfEx2EvI85T3Pr9CbAxGWZUdpvebPmOQe3Iclb9mQy1CrxQqD9RSaSz+c:bf723T3z9ZbbPHNy18xQqpx8O5JZ

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

cffe1bd1ee6f62dbf92b5ef86f0f7098bc7b301b37bec1b0e6b2d24051184232.exe

description	pid	process	target process
PID 3556 wrote to memory of 1504	3556	cffe1bd1ee6f62dbf92b5ef86f0f7098bc7b301b37bec1b0e6b2d24051184232.exe	cffe1bd1ee6f62dbf92b5ef86f0f7098bc7b301b37bec1b0e6b2d24051184232.exe
PID 3556 wrote to memory of 1504	3556	cffe1bd1ee6f62dbf92b5ef86f0f7098bc7b301b37bec1b0e6b2d24051184232.exe	cffe1bd1ee6f62dbf92b5ef86f0f7098bc7b301b37bec1b0e6b2d24051184232.exe
PID 3556 wrote to memory of 1504	3556	cffe1bd1ee6f62dbf92b5ef86f0f7098bc7b301b37bec1b0e6b2d24051184232.exe	cffe1bd1ee6f62dbf92b5ef86f0f7098bc7b301b37bec1b0e6b2d24051184232.exe
PID 3556 wrote to memory of 3640	3556	cffe1bd1ee6f62dbf92b5ef86f0f7098bc7b301b37bec1b0e6b2d24051184232.exe	cffe1bd1ee6f62dbf92b5ef86f0f7098bc7b301b37bec1b0e6b2d24051184232.exe
PID 3556 wrote to memory of 3640	3556	cffe1bd1ee6f62dbf92b5ef86f0f7098bc7b301b37bec1b0e6b2d24051184232.exe	cffe1bd1ee6f62dbf92b5ef86f0f7098bc7b301b37bec1b0e6b2d24051184232.exe
PID 3556 wrote to memory of 3640	3556	cffe1bd1ee6f62dbf92b5ef86f0f7098bc7b301b37bec1b0e6b2d24051184232.exe	cffe1bd1ee6f62dbf92b5ef86f0f7098bc7b301b37bec1b0e6b2d24051184232.exe

C:\Users\Admin\AppData\Local\Temp\cffe1bd1ee6f62dbf92b5ef86f0f7098bc7b301b37bec1b0e6b2d24051184232.exe
"C:\Users\Admin\AppData\Local\Temp\cffe1bd1ee6f62dbf92b5ef86f0f7098bc7b301b37bec1b0e6b2d24051184232.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3556

C:\Users\Admin\AppData\Local\Temp\cffe1bd1ee6f62dbf92b5ef86f0f7098bc7b301b37bec1b0e6b2d24051184232.exe
start
2⤵
PID:1504

C:\Users\Admin\AppData\Local\Temp\cffe1bd1ee6f62dbf92b5ef86f0f7098bc7b301b37bec1b0e6b2d24051184232.exe
watch
2⤵
PID:3640

memory/1504-135-0x0000000000000000-mapping.dmp

Download
memory/1504-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1504-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1504-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3556-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3556-133-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3556-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3640-134-0x0000000000000000-mapping.dmp

Download
memory/3640-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3640-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3640-142-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download