94deed9ff8dae38974e8c92a27c622f1ef76b86898d657a3f0ea6e2702c68c8b

Analysis

max time kernel
157s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:37

Target

94deed9ff8dae38974e8c92a27c622f1ef76b86898d657a3f0ea6e2702c68c8b.exe
Size

522KB
MD5

d02bc8ab6f980b1f486f14100d492150
SHA1

f348f2011f6593b7c60223c609ce51f53bb14f4e
SHA256

94deed9ff8dae38974e8c92a27c622f1ef76b86898d657a3f0ea6e2702c68c8b
SHA512

4592812802ea2bbec47cb454fde9f5d3fcc05f6ca0705b09d9054452d4bdf0166340c39598f3676d04549b5f39c651c66e5dace6d7cb28d8d552b293d9d40d99
SSDEEP

12288:iGR9hp8UDdy2eavrqDy18xQqpx8O5jQC:ikhp8UDs2eavr8atqpx8O

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

94deed9ff8dae38974e8c92a27c622f1ef76b86898d657a3f0ea6e2702c68c8b.exe

description	pid	process	target process
PID 3792 wrote to memory of 2352	3792	94deed9ff8dae38974e8c92a27c622f1ef76b86898d657a3f0ea6e2702c68c8b.exe	94deed9ff8dae38974e8c92a27c622f1ef76b86898d657a3f0ea6e2702c68c8b.exe
PID 3792 wrote to memory of 2352	3792	94deed9ff8dae38974e8c92a27c622f1ef76b86898d657a3f0ea6e2702c68c8b.exe	94deed9ff8dae38974e8c92a27c622f1ef76b86898d657a3f0ea6e2702c68c8b.exe
PID 3792 wrote to memory of 2352	3792	94deed9ff8dae38974e8c92a27c622f1ef76b86898d657a3f0ea6e2702c68c8b.exe	94deed9ff8dae38974e8c92a27c622f1ef76b86898d657a3f0ea6e2702c68c8b.exe
PID 3792 wrote to memory of 1480	3792	94deed9ff8dae38974e8c92a27c622f1ef76b86898d657a3f0ea6e2702c68c8b.exe	94deed9ff8dae38974e8c92a27c622f1ef76b86898d657a3f0ea6e2702c68c8b.exe
PID 3792 wrote to memory of 1480	3792	94deed9ff8dae38974e8c92a27c622f1ef76b86898d657a3f0ea6e2702c68c8b.exe	94deed9ff8dae38974e8c92a27c622f1ef76b86898d657a3f0ea6e2702c68c8b.exe
PID 3792 wrote to memory of 1480	3792	94deed9ff8dae38974e8c92a27c622f1ef76b86898d657a3f0ea6e2702c68c8b.exe	94deed9ff8dae38974e8c92a27c622f1ef76b86898d657a3f0ea6e2702c68c8b.exe

C:\Users\Admin\AppData\Local\Temp\94deed9ff8dae38974e8c92a27c622f1ef76b86898d657a3f0ea6e2702c68c8b.exe
"C:\Users\Admin\AppData\Local\Temp\94deed9ff8dae38974e8c92a27c622f1ef76b86898d657a3f0ea6e2702c68c8b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3792

C:\Users\Admin\AppData\Local\Temp\94deed9ff8dae38974e8c92a27c622f1ef76b86898d657a3f0ea6e2702c68c8b.exe
start
2⤵
PID:2352

C:\Users\Admin\AppData\Local\Temp\94deed9ff8dae38974e8c92a27c622f1ef76b86898d657a3f0ea6e2702c68c8b.exe
watch
2⤵
PID:1480

memory/1480-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1480-133-0x0000000000000000-mapping.dmp

Download
memory/1480-145-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1480-142-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1480-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1480-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2352-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2352-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2352-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2352-143-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2352-144-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2352-134-0x0000000000000000-mapping.dmp

Download
memory/3792-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3792-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download