a2e9ca875b6a8e7ef2867aa8230e667cf33f59c19de3e30a40991ba14d923fdd

Analysis

max time kernel
199s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:30

Target

a2e9ca875b6a8e7ef2867aa8230e667cf33f59c19de3e30a40991ba14d923fdd.exe
Size

518KB
MD5

5ec3ca30ae9744d482ea9aae14938af6
SHA1

ba0cc2691d4681649f7438d33d54fc2f9aef1f6a
SHA256

a2e9ca875b6a8e7ef2867aa8230e667cf33f59c19de3e30a40991ba14d923fdd
SHA512

5efcd2bd32d4e9eb56fb29b9c4f82f18719ce124d2e1994a7380aeb2134272423fc22bfd1833aa6c3f2e38e7455b04f9a5e655e93188e183544883d0b0cbf425
SSDEEP

12288:LN+8zI/vXF1vOc9HAWhpgawPUjASES/ya+WJPwTOEZ/S:LE5/v3vOc9gbFPuAsz+OPwTvZ/

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

a2e9ca875b6a8e7ef2867aa8230e667cf33f59c19de3e30a40991ba14d923fdd.exe

description	pid	process	target process
PID 2392 wrote to memory of 4796	2392	a2e9ca875b6a8e7ef2867aa8230e667cf33f59c19de3e30a40991ba14d923fdd.exe	a2e9ca875b6a8e7ef2867aa8230e667cf33f59c19de3e30a40991ba14d923fdd.exe
PID 2392 wrote to memory of 4796	2392	a2e9ca875b6a8e7ef2867aa8230e667cf33f59c19de3e30a40991ba14d923fdd.exe	a2e9ca875b6a8e7ef2867aa8230e667cf33f59c19de3e30a40991ba14d923fdd.exe
PID 2392 wrote to memory of 4796	2392	a2e9ca875b6a8e7ef2867aa8230e667cf33f59c19de3e30a40991ba14d923fdd.exe	a2e9ca875b6a8e7ef2867aa8230e667cf33f59c19de3e30a40991ba14d923fdd.exe
PID 2392 wrote to memory of 3008	2392	a2e9ca875b6a8e7ef2867aa8230e667cf33f59c19de3e30a40991ba14d923fdd.exe	a2e9ca875b6a8e7ef2867aa8230e667cf33f59c19de3e30a40991ba14d923fdd.exe
PID 2392 wrote to memory of 3008	2392	a2e9ca875b6a8e7ef2867aa8230e667cf33f59c19de3e30a40991ba14d923fdd.exe	a2e9ca875b6a8e7ef2867aa8230e667cf33f59c19de3e30a40991ba14d923fdd.exe
PID 2392 wrote to memory of 3008	2392	a2e9ca875b6a8e7ef2867aa8230e667cf33f59c19de3e30a40991ba14d923fdd.exe	a2e9ca875b6a8e7ef2867aa8230e667cf33f59c19de3e30a40991ba14d923fdd.exe

C:\Users\Admin\AppData\Local\Temp\a2e9ca875b6a8e7ef2867aa8230e667cf33f59c19de3e30a40991ba14d923fdd.exe
"C:\Users\Admin\AppData\Local\Temp\a2e9ca875b6a8e7ef2867aa8230e667cf33f59c19de3e30a40991ba14d923fdd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2392

C:\Users\Admin\AppData\Local\Temp\a2e9ca875b6a8e7ef2867aa8230e667cf33f59c19de3e30a40991ba14d923fdd.exe
start
2⤵
PID:4796

C:\Users\Admin\AppData\Local\Temp\a2e9ca875b6a8e7ef2867aa8230e667cf33f59c19de3e30a40991ba14d923fdd.exe
watch
2⤵
PID:3008

memory/2392-132-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2392-135-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3008-133-0x0000000000000000-mapping.dmp

Download
memory/3008-136-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3008-139-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4796-134-0x0000000000000000-mapping.dmp

Download
memory/4796-137-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4796-138-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download