a094e1d649dac5c01faa93313502389fe0e12d9115e36daf907c5db23cad6bc3

Analysis

max time kernel
78s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:31

Target

a094e1d649dac5c01faa93313502389fe0e12d9115e36daf907c5db23cad6bc3.exe
Size

518KB
MD5

88b59cb5bb791204dfd0090362d31004
SHA1

da2d895e77dd33785128312ff218af918d310180
SHA256

a094e1d649dac5c01faa93313502389fe0e12d9115e36daf907c5db23cad6bc3
SHA512

632690863ddcc1e9011ddc9f7bf163081feb7a2160557d3989f3c0e76afc3e46d99fe1d47e41106621a4ff196f55fcbc91f51993bf72fd25be9de975e7490c9a
SSDEEP

12288:OW8Qew1SKYsoxFbg3XyvwPUjASES/ya+WJPwTOEv/sk:R8eSKYjx5GnPuAsz+OPwTvv/n

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

a094e1d649dac5c01faa93313502389fe0e12d9115e36daf907c5db23cad6bc3.exe

description	pid	process	target process
PID 2824 wrote to memory of 4584	2824	a094e1d649dac5c01faa93313502389fe0e12d9115e36daf907c5db23cad6bc3.exe	a094e1d649dac5c01faa93313502389fe0e12d9115e36daf907c5db23cad6bc3.exe
PID 2824 wrote to memory of 4584	2824	a094e1d649dac5c01faa93313502389fe0e12d9115e36daf907c5db23cad6bc3.exe	a094e1d649dac5c01faa93313502389fe0e12d9115e36daf907c5db23cad6bc3.exe
PID 2824 wrote to memory of 4584	2824	a094e1d649dac5c01faa93313502389fe0e12d9115e36daf907c5db23cad6bc3.exe	a094e1d649dac5c01faa93313502389fe0e12d9115e36daf907c5db23cad6bc3.exe
PID 2824 wrote to memory of 1528	2824	a094e1d649dac5c01faa93313502389fe0e12d9115e36daf907c5db23cad6bc3.exe	a094e1d649dac5c01faa93313502389fe0e12d9115e36daf907c5db23cad6bc3.exe
PID 2824 wrote to memory of 1528	2824	a094e1d649dac5c01faa93313502389fe0e12d9115e36daf907c5db23cad6bc3.exe	a094e1d649dac5c01faa93313502389fe0e12d9115e36daf907c5db23cad6bc3.exe
PID 2824 wrote to memory of 1528	2824	a094e1d649dac5c01faa93313502389fe0e12d9115e36daf907c5db23cad6bc3.exe	a094e1d649dac5c01faa93313502389fe0e12d9115e36daf907c5db23cad6bc3.exe

C:\Users\Admin\AppData\Local\Temp\a094e1d649dac5c01faa93313502389fe0e12d9115e36daf907c5db23cad6bc3.exe
"C:\Users\Admin\AppData\Local\Temp\a094e1d649dac5c01faa93313502389fe0e12d9115e36daf907c5db23cad6bc3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2824

C:\Users\Admin\AppData\Local\Temp\a094e1d649dac5c01faa93313502389fe0e12d9115e36daf907c5db23cad6bc3.exe
start
2⤵
PID:4584

C:\Users\Admin\AppData\Local\Temp\a094e1d649dac5c01faa93313502389fe0e12d9115e36daf907c5db23cad6bc3.exe
watch
2⤵
PID:1528

memory/1528-133-0x0000000000000000-mapping.dmp

Download
memory/1528-136-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1528-139-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2824-132-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2824-135-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4584-134-0x0000000000000000-mapping.dmp

Download
memory/4584-137-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4584-138-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download