af63d1700dd33cdfd3789734281e19aa3c95f9f74d8202bb372f65c3e726086a

Analysis

max time kernel
91s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:22

Target

af63d1700dd33cdfd3789734281e19aa3c95f9f74d8202bb372f65c3e726086a.exe
Size

537KB
MD5

2d9f35c895e484fecd99ef6f514d6150
SHA1

9f82f85b7b010d093e4a993aabb5d7f7b63a1d5d
SHA256

af63d1700dd33cdfd3789734281e19aa3c95f9f74d8202bb372f65c3e726086a
SHA512

a7013de0b62100cbe74d67e441ff10a1ff74ca649adcaa8f230f1f364ab36d9b7036fc060373087349d9c3be82f386639f6b95ecbee30857146307e464572a14
SSDEEP

12288:Jt2UvfEEsiGrm9Z1MpyCqi8ka8nmCEJdTye63QmeBR:L2UvfMi3/1MpXqi8kJcDmev

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

af63d1700dd33cdfd3789734281e19aa3c95f9f74d8202bb372f65c3e726086a.exe

description	pid	process	target process
PID 1692 wrote to memory of 2444	1692	af63d1700dd33cdfd3789734281e19aa3c95f9f74d8202bb372f65c3e726086a.exe	af63d1700dd33cdfd3789734281e19aa3c95f9f74d8202bb372f65c3e726086a.exe
PID 1692 wrote to memory of 2444	1692	af63d1700dd33cdfd3789734281e19aa3c95f9f74d8202bb372f65c3e726086a.exe	af63d1700dd33cdfd3789734281e19aa3c95f9f74d8202bb372f65c3e726086a.exe
PID 1692 wrote to memory of 2444	1692	af63d1700dd33cdfd3789734281e19aa3c95f9f74d8202bb372f65c3e726086a.exe	af63d1700dd33cdfd3789734281e19aa3c95f9f74d8202bb372f65c3e726086a.exe

C:\Users\Admin\AppData\Local\Temp\af63d1700dd33cdfd3789734281e19aa3c95f9f74d8202bb372f65c3e726086a.exe
"C:\Users\Admin\AppData\Local\Temp\af63d1700dd33cdfd3789734281e19aa3c95f9f74d8202bb372f65c3e726086a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1692

C:\Users\Admin\AppData\Local\Temp\af63d1700dd33cdfd3789734281e19aa3c95f9f74d8202bb372f65c3e726086a.exe
tear
2⤵
PID:2444

memory/1692-133-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2444-132-0x0000000000000000-mapping.dmp

Download
memory/2444-134-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2444-135-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download