969ecbc552255ba72b48bad8ec4533ded96c5d6e9450eaf2bcc2be00a5cbbc0b

Analysis

max time kernel
112s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:36

Target

969ecbc552255ba72b48bad8ec4533ded96c5d6e9450eaf2bcc2be00a5cbbc0b.exe
Size

524KB
MD5

5dae2f9b14ba77a9d85d67177f83cdf8
SHA1

de59efcebc0db976d1f14d4507330567c698d71f
SHA256

969ecbc552255ba72b48bad8ec4533ded96c5d6e9450eaf2bcc2be00a5cbbc0b
SHA512

178b70257e6be54444012234adbd0e69a6f1494ce0ea6324b960a7ae645c609a84969bfa49d040bd9b55ee691c4b8bbc85e7d061ed96c21c328e6f7078199c58
SSDEEP

12288:EpUHSzSosp4j464pdgaxIWv4bON/uL63PTb/g0OJp/KbORj:2NlsL618Oy/uE/QfyEj

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

969ecbc552255ba72b48bad8ec4533ded96c5d6e9450eaf2bcc2be00a5cbbc0b.exe

description	pid	process	target process
PID 1756 wrote to memory of 5012	1756	969ecbc552255ba72b48bad8ec4533ded96c5d6e9450eaf2bcc2be00a5cbbc0b.exe	969ecbc552255ba72b48bad8ec4533ded96c5d6e9450eaf2bcc2be00a5cbbc0b.exe
PID 1756 wrote to memory of 5012	1756	969ecbc552255ba72b48bad8ec4533ded96c5d6e9450eaf2bcc2be00a5cbbc0b.exe	969ecbc552255ba72b48bad8ec4533ded96c5d6e9450eaf2bcc2be00a5cbbc0b.exe
PID 1756 wrote to memory of 5012	1756	969ecbc552255ba72b48bad8ec4533ded96c5d6e9450eaf2bcc2be00a5cbbc0b.exe	969ecbc552255ba72b48bad8ec4533ded96c5d6e9450eaf2bcc2be00a5cbbc0b.exe
PID 1756 wrote to memory of 1600	1756	969ecbc552255ba72b48bad8ec4533ded96c5d6e9450eaf2bcc2be00a5cbbc0b.exe	969ecbc552255ba72b48bad8ec4533ded96c5d6e9450eaf2bcc2be00a5cbbc0b.exe
PID 1756 wrote to memory of 1600	1756	969ecbc552255ba72b48bad8ec4533ded96c5d6e9450eaf2bcc2be00a5cbbc0b.exe	969ecbc552255ba72b48bad8ec4533ded96c5d6e9450eaf2bcc2be00a5cbbc0b.exe
PID 1756 wrote to memory of 1600	1756	969ecbc552255ba72b48bad8ec4533ded96c5d6e9450eaf2bcc2be00a5cbbc0b.exe	969ecbc552255ba72b48bad8ec4533ded96c5d6e9450eaf2bcc2be00a5cbbc0b.exe

C:\Users\Admin\AppData\Local\Temp\969ecbc552255ba72b48bad8ec4533ded96c5d6e9450eaf2bcc2be00a5cbbc0b.exe
"C:\Users\Admin\AppData\Local\Temp\969ecbc552255ba72b48bad8ec4533ded96c5d6e9450eaf2bcc2be00a5cbbc0b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1756

C:\Users\Admin\AppData\Local\Temp\969ecbc552255ba72b48bad8ec4533ded96c5d6e9450eaf2bcc2be00a5cbbc0b.exe
start
2⤵
PID:5012

C:\Users\Admin\AppData\Local\Temp\969ecbc552255ba72b48bad8ec4533ded96c5d6e9450eaf2bcc2be00a5cbbc0b.exe
watch
2⤵
PID:1600

memory/1600-132-0x0000000000000000-mapping.dmp

Download
memory/1600-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1600-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1756-134-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/5012-133-0x0000000000000000-mapping.dmp

Download
memory/5012-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/5012-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download