22e4d44ea0ebb8f1feb4de7712923ebde4a0105f6037eed261ecadaba7b5d511

Analysis

max time kernel
144s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:47

Target

22e4d44ea0ebb8f1feb4de7712923ebde4a0105f6037eed261ecadaba7b5d511.exe
Size

518KB
MD5

b6441f247ba1da81ae4821ca7bf95753
SHA1

1d4d393854282ae8cab409aa58ccb7a62a75a100
SHA256

22e4d44ea0ebb8f1feb4de7712923ebde4a0105f6037eed261ecadaba7b5d511
SHA512

a462cb6d263e17492e42b7286c76399c7638b2cc36a36e6f5a9009873aeb3712ddd8b025a87f8887163c0ab23c0508e6a7207cae17b86bcd7d4d359d5f5625bf
SSDEEP

12288:eAouI3oxjl0AOpwPUjASES/ya+WJPwTOEQ/e:IuI300AHPuAsz+OPwTvQ/

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

22e4d44ea0ebb8f1feb4de7712923ebde4a0105f6037eed261ecadaba7b5d511.exe

description	pid	process	target process
PID 4904 wrote to memory of 4540	4904	22e4d44ea0ebb8f1feb4de7712923ebde4a0105f6037eed261ecadaba7b5d511.exe	22e4d44ea0ebb8f1feb4de7712923ebde4a0105f6037eed261ecadaba7b5d511.exe
PID 4904 wrote to memory of 4540	4904	22e4d44ea0ebb8f1feb4de7712923ebde4a0105f6037eed261ecadaba7b5d511.exe	22e4d44ea0ebb8f1feb4de7712923ebde4a0105f6037eed261ecadaba7b5d511.exe
PID 4904 wrote to memory of 4540	4904	22e4d44ea0ebb8f1feb4de7712923ebde4a0105f6037eed261ecadaba7b5d511.exe	22e4d44ea0ebb8f1feb4de7712923ebde4a0105f6037eed261ecadaba7b5d511.exe
PID 4904 wrote to memory of 3132	4904	22e4d44ea0ebb8f1feb4de7712923ebde4a0105f6037eed261ecadaba7b5d511.exe	22e4d44ea0ebb8f1feb4de7712923ebde4a0105f6037eed261ecadaba7b5d511.exe
PID 4904 wrote to memory of 3132	4904	22e4d44ea0ebb8f1feb4de7712923ebde4a0105f6037eed261ecadaba7b5d511.exe	22e4d44ea0ebb8f1feb4de7712923ebde4a0105f6037eed261ecadaba7b5d511.exe
PID 4904 wrote to memory of 3132	4904	22e4d44ea0ebb8f1feb4de7712923ebde4a0105f6037eed261ecadaba7b5d511.exe	22e4d44ea0ebb8f1feb4de7712923ebde4a0105f6037eed261ecadaba7b5d511.exe

C:\Users\Admin\AppData\Local\Temp\22e4d44ea0ebb8f1feb4de7712923ebde4a0105f6037eed261ecadaba7b5d511.exe
"C:\Users\Admin\AppData\Local\Temp\22e4d44ea0ebb8f1feb4de7712923ebde4a0105f6037eed261ecadaba7b5d511.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4904

C:\Users\Admin\AppData\Local\Temp\22e4d44ea0ebb8f1feb4de7712923ebde4a0105f6037eed261ecadaba7b5d511.exe
start
2⤵
PID:4540

C:\Users\Admin\AppData\Local\Temp\22e4d44ea0ebb8f1feb4de7712923ebde4a0105f6037eed261ecadaba7b5d511.exe
watch
2⤵
PID:3132

memory/3132-132-0x0000000000000000-mapping.dmp

Download
memory/3132-136-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3132-138-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4540-133-0x0000000000000000-mapping.dmp

Download
memory/4540-135-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4540-137-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4904-134-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download