28198715be24d0aa13b5df3cc3092526b6e54e8f22569d141fa4697a673f3538

Analysis

max time kernel
75s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:44

Target

28198715be24d0aa13b5df3cc3092526b6e54e8f22569d141fa4697a673f3538.exe
Size

522KB
MD5

d4d55c32f56503a7338664b294eaee24
SHA1

b1c0636e0028e2dda6febfc88aaaf89777622360
SHA256

28198715be24d0aa13b5df3cc3092526b6e54e8f22569d141fa4697a673f3538
SHA512

6b2a7d4039e4a06d73a8b6a09c810b79cffb5b7962bd6aa8b91db82d31152876837311d76330307ffa4e3e4b37e72c84bb20b6c1cf2059fa0085e175def5dd7b
SSDEEP

6144:8O4j4/m+ugRVwCHQ7fx9AF7QksespFJ52B+Pw8p2vz0aCouCaqpUxdrZPkTY/21U:/5Nyx96sxk78sCfCDpwtWsjYO9Atww8

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

28198715be24d0aa13b5df3cc3092526b6e54e8f22569d141fa4697a673f3538.exe

description	pid	process	target process
PID 2548 wrote to memory of 3168	2548	28198715be24d0aa13b5df3cc3092526b6e54e8f22569d141fa4697a673f3538.exe	28198715be24d0aa13b5df3cc3092526b6e54e8f22569d141fa4697a673f3538.exe
PID 2548 wrote to memory of 3168	2548	28198715be24d0aa13b5df3cc3092526b6e54e8f22569d141fa4697a673f3538.exe	28198715be24d0aa13b5df3cc3092526b6e54e8f22569d141fa4697a673f3538.exe
PID 2548 wrote to memory of 3168	2548	28198715be24d0aa13b5df3cc3092526b6e54e8f22569d141fa4697a673f3538.exe	28198715be24d0aa13b5df3cc3092526b6e54e8f22569d141fa4697a673f3538.exe
PID 2548 wrote to memory of 4596	2548	28198715be24d0aa13b5df3cc3092526b6e54e8f22569d141fa4697a673f3538.exe	28198715be24d0aa13b5df3cc3092526b6e54e8f22569d141fa4697a673f3538.exe
PID 2548 wrote to memory of 4596	2548	28198715be24d0aa13b5df3cc3092526b6e54e8f22569d141fa4697a673f3538.exe	28198715be24d0aa13b5df3cc3092526b6e54e8f22569d141fa4697a673f3538.exe
PID 2548 wrote to memory of 4596	2548	28198715be24d0aa13b5df3cc3092526b6e54e8f22569d141fa4697a673f3538.exe	28198715be24d0aa13b5df3cc3092526b6e54e8f22569d141fa4697a673f3538.exe

C:\Users\Admin\AppData\Local\Temp\28198715be24d0aa13b5df3cc3092526b6e54e8f22569d141fa4697a673f3538.exe
"C:\Users\Admin\AppData\Local\Temp\28198715be24d0aa13b5df3cc3092526b6e54e8f22569d141fa4697a673f3538.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2548

C:\Users\Admin\AppData\Local\Temp\28198715be24d0aa13b5df3cc3092526b6e54e8f22569d141fa4697a673f3538.exe
start
2⤵
PID:3168

C:\Users\Admin\AppData\Local\Temp\28198715be24d0aa13b5df3cc3092526b6e54e8f22569d141fa4697a673f3538.exe
watch
2⤵
PID:4596

memory/2548-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2548-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3168-134-0x0000000000000000-mapping.dmp

Download
memory/3168-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3168-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3168-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4596-133-0x0000000000000000-mapping.dmp

Download
memory/4596-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4596-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4596-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download