2f3f2356accb36a6759b9564402b208bb27424a9f3c25f513d324b0c0339315d

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:40

Target

2f3f2356accb36a6759b9564402b208bb27424a9f3c25f513d324b0c0339315d.exe
Size

522KB
MD5

f0660c4705b349af53fd4c3440fcdb41
SHA1

d832811affda5c408777e87b0b496cb0756a8c11
SHA256

2f3f2356accb36a6759b9564402b208bb27424a9f3c25f513d324b0c0339315d
SHA512

38c9802131c466cd3c79f821dee8465b4bac267ce8bfc62e7b84cd1bcbd9e263b928496b97fdf965eeb5f1a459e26ee7f703ddc1ffb8db956455bf430b11574c
SSDEEP

6144:gQZRDvBlUOc6tYO5yAad+/IcIQNKlkXNV2XOt7Tnto/5mQy1CrxQqD9RSaSz+8Or:tDD5UFOv8kXNY+5jtyLy18xQqpx8O5t

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

2f3f2356accb36a6759b9564402b208bb27424a9f3c25f513d324b0c0339315d.exe

description	pid	process	target process
PID 4800 wrote to memory of 1500	4800	2f3f2356accb36a6759b9564402b208bb27424a9f3c25f513d324b0c0339315d.exe	2f3f2356accb36a6759b9564402b208bb27424a9f3c25f513d324b0c0339315d.exe
PID 4800 wrote to memory of 1500	4800	2f3f2356accb36a6759b9564402b208bb27424a9f3c25f513d324b0c0339315d.exe	2f3f2356accb36a6759b9564402b208bb27424a9f3c25f513d324b0c0339315d.exe
PID 4800 wrote to memory of 1500	4800	2f3f2356accb36a6759b9564402b208bb27424a9f3c25f513d324b0c0339315d.exe	2f3f2356accb36a6759b9564402b208bb27424a9f3c25f513d324b0c0339315d.exe
PID 4800 wrote to memory of 1208	4800	2f3f2356accb36a6759b9564402b208bb27424a9f3c25f513d324b0c0339315d.exe	2f3f2356accb36a6759b9564402b208bb27424a9f3c25f513d324b0c0339315d.exe
PID 4800 wrote to memory of 1208	4800	2f3f2356accb36a6759b9564402b208bb27424a9f3c25f513d324b0c0339315d.exe	2f3f2356accb36a6759b9564402b208bb27424a9f3c25f513d324b0c0339315d.exe
PID 4800 wrote to memory of 1208	4800	2f3f2356accb36a6759b9564402b208bb27424a9f3c25f513d324b0c0339315d.exe	2f3f2356accb36a6759b9564402b208bb27424a9f3c25f513d324b0c0339315d.exe

C:\Users\Admin\AppData\Local\Temp\2f3f2356accb36a6759b9564402b208bb27424a9f3c25f513d324b0c0339315d.exe
"C:\Users\Admin\AppData\Local\Temp\2f3f2356accb36a6759b9564402b208bb27424a9f3c25f513d324b0c0339315d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4800

C:\Users\Admin\AppData\Local\Temp\2f3f2356accb36a6759b9564402b208bb27424a9f3c25f513d324b0c0339315d.exe
start
2⤵
PID:1500

C:\Users\Admin\AppData\Local\Temp\2f3f2356accb36a6759b9564402b208bb27424a9f3c25f513d324b0c0339315d.exe
watch
2⤵
PID:1208

memory/1208-133-0x0000000000000000-mapping.dmp

Download
memory/1208-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1208-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1208-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1208-143-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1500-134-0x0000000000000000-mapping.dmp

Download
memory/1500-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1500-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1500-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1500-142-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4800-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4800-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download