631056de9dafeaa396117357d9f618be4e42394e87f5d66f651271f42e5ef624

Analysis

max time kernel
206s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:08

Target

631056de9dafeaa396117357d9f618be4e42394e87f5d66f651271f42e5ef624.exe
Size

524KB
MD5

9a1e7163822974e0c8784edb9302ebe2
SHA1

d8fa86d1c3108ed2e27e36aa5c601d5d842aee0b
SHA256

631056de9dafeaa396117357d9f618be4e42394e87f5d66f651271f42e5ef624
SHA512

9957f84daee0c1ccce36af8309584b33b4e7c582cba44cc4bb4acabcfd32628b98512085743368e4653d55ec5d01f700aad2a168ec60cb4736f46e5fbfec2afb
SSDEEP

12288:ksEN8JSM0y5eleSt+jK5v4t8a5tFZ8WVzvBVKXCuapzDBG:J506Wx+cv8XTfHVzvSXCXD

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

631056de9dafeaa396117357d9f618be4e42394e87f5d66f651271f42e5ef624.exe

description	pid	process	target process
PID 1064 wrote to memory of 3548	1064	631056de9dafeaa396117357d9f618be4e42394e87f5d66f651271f42e5ef624.exe	631056de9dafeaa396117357d9f618be4e42394e87f5d66f651271f42e5ef624.exe
PID 1064 wrote to memory of 3548	1064	631056de9dafeaa396117357d9f618be4e42394e87f5d66f651271f42e5ef624.exe	631056de9dafeaa396117357d9f618be4e42394e87f5d66f651271f42e5ef624.exe
PID 1064 wrote to memory of 3548	1064	631056de9dafeaa396117357d9f618be4e42394e87f5d66f651271f42e5ef624.exe	631056de9dafeaa396117357d9f618be4e42394e87f5d66f651271f42e5ef624.exe

C:\Users\Admin\AppData\Local\Temp\631056de9dafeaa396117357d9f618be4e42394e87f5d66f651271f42e5ef624.exe
"C:\Users\Admin\AppData\Local\Temp\631056de9dafeaa396117357d9f618be4e42394e87f5d66f651271f42e5ef624.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Users\Admin\AppData\Local\Temp\631056de9dafeaa396117357d9f618be4e42394e87f5d66f651271f42e5ef624.exe
  tear
  2⤵
  PID:3548

memory/1064-132-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1064-135-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1064-134-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/3548-133-0x0000000000000000-mapping.dmp

Download
memory/3548-136-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/3548-137-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/3548-138-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download