2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a

Analysis

max time kernel
183s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:40

Target

2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe
Size

522KB
MD5

2705e3e3416d6ff65ee39564f582a3d7
SHA1

3ba25880667a804b01528da4033c6e542b824588
SHA256

2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a
SHA512

fe07c28a4f938b1c04deae4ddbcf2f2c72e8ec137c1bbd427a151030025e70eb38b6491a4e327a37febd1cb417ba8cb20eee57fb3d712f78ec5f84220434993f
SSDEEP

6144:O9TDTBiIQLA0ersSwQM7CrNycmwRSGQ7jCFAPPmQy1CrxQqD9RSaSz+8O5feMW:kPrPw0ycbR7Aty18xQqpx8O5fz

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe

description	pid	process	target process
PID 2984 wrote to memory of 1640	2984	2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe	2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe
PID 2984 wrote to memory of 1640	2984	2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe	2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe
PID 2984 wrote to memory of 1640	2984	2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe	2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe
PID 2984 wrote to memory of 4072	2984	2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe	2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe
PID 2984 wrote to memory of 4072	2984	2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe	2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe
PID 2984 wrote to memory of 4072	2984	2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe	2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe

C:\Users\Admin\AppData\Local\Temp\2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe
"C:\Users\Admin\AppData\Local\Temp\2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2984

C:\Users\Admin\AppData\Local\Temp\2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe
start
2⤵
PID:1640

C:\Users\Admin\AppData\Local\Temp\2f84f20708236e7c70298bb531c0a94aa43843bb5b8d48c0223a5867d7e9404a.exe
watch
2⤵
PID:4072

memory/1640-134-0x0000000000000000-mapping.dmp

Download
memory/1640-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1640-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1640-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2984-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2984-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4072-133-0x0000000000000000-mapping.dmp

Download
memory/4072-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4072-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4072-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download