310206235a414968fab457fd63b58a87e104d454441c0d8914671580900e5400

Analysis

max time kernel
183s
max time network
199s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:39

Target

310206235a414968fab457fd63b58a87e104d454441c0d8914671580900e5400.exe
Size

532KB
MD5

9b906f17f88fbd43e7f13432aa5ab1f4
SHA1

589e08467cb94d724b45484bdaf3b8399da6edc4
SHA256

310206235a414968fab457fd63b58a87e104d454441c0d8914671580900e5400
SHA512

a2ee6cffee32648abfdf506608a1430c1e9feb8d47c6a3e0d25b9bf986f4843b931c636e9d621d1d169f5029420dad34ed0d448cc3f02a26af552f88dc321892
SSDEEP

12288:U4xipmsdFd1Pv2toPh2RIbWcoIFFEgB9nP1o:NO5VNp0IbWcoIFagbP6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

310206235a414968fab457fd63b58a87e104d454441c0d8914671580900e5400.exe

description	pid	process	target process
PID 3776 wrote to memory of 4928	3776	310206235a414968fab457fd63b58a87e104d454441c0d8914671580900e5400.exe	310206235a414968fab457fd63b58a87e104d454441c0d8914671580900e5400.exe
PID 3776 wrote to memory of 4928	3776	310206235a414968fab457fd63b58a87e104d454441c0d8914671580900e5400.exe	310206235a414968fab457fd63b58a87e104d454441c0d8914671580900e5400.exe
PID 3776 wrote to memory of 4928	3776	310206235a414968fab457fd63b58a87e104d454441c0d8914671580900e5400.exe	310206235a414968fab457fd63b58a87e104d454441c0d8914671580900e5400.exe

C:\Users\Admin\AppData\Local\Temp\310206235a414968fab457fd63b58a87e104d454441c0d8914671580900e5400.exe
"C:\Users\Admin\AppData\Local\Temp\310206235a414968fab457fd63b58a87e104d454441c0d8914671580900e5400.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3776

C:\Users\Admin\AppData\Local\Temp\310206235a414968fab457fd63b58a87e104d454441c0d8914671580900e5400.exe
tear
2⤵
PID:4928

memory/3776-133-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4928-132-0x0000000000000000-mapping.dmp

Download
memory/4928-134-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4928-135-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download