56125347cb0694b2893eb25373a1d277756594eaa690fb2cfa4c243361dd8a06

Analysis

max time kernel
274s
max time network
311s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:17

Target

56125347cb0694b2893eb25373a1d277756594eaa690fb2cfa4c243361dd8a06.exe
Size

521KB
MD5

ced4a5ff66a0a54a498a96519fd22ab6
SHA1

b8299e3e42472f40ea760e0be6995becbf123373
SHA256

56125347cb0694b2893eb25373a1d277756594eaa690fb2cfa4c243361dd8a06
SHA512

57220186b6a07a4acc1a8a85320bdba0cdb81a4b8effd0cac99d4461f1c9d7916f8f1897eb3cd2975558ab8fea65474f0ba533ec92c6d179583f53e637ec1017
SSDEEP

6144:odl+k5ZIZTnsc+C2gA3EfmMuJ6ihz2zkCyvag7pDvrTosSHrqv3Sg8Gf8yRtD3iM:on+iZVcnA0X3ohrTovvGexGWRLU1

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

56125347cb0694b2893eb25373a1d277756594eaa690fb2cfa4c243361dd8a06.exe

description	pid	process	target process
PID 3700 wrote to memory of 3248	3700	56125347cb0694b2893eb25373a1d277756594eaa690fb2cfa4c243361dd8a06.exe	56125347cb0694b2893eb25373a1d277756594eaa690fb2cfa4c243361dd8a06.exe
PID 3700 wrote to memory of 3248	3700	56125347cb0694b2893eb25373a1d277756594eaa690fb2cfa4c243361dd8a06.exe	56125347cb0694b2893eb25373a1d277756594eaa690fb2cfa4c243361dd8a06.exe
PID 3700 wrote to memory of 3248	3700	56125347cb0694b2893eb25373a1d277756594eaa690fb2cfa4c243361dd8a06.exe	56125347cb0694b2893eb25373a1d277756594eaa690fb2cfa4c243361dd8a06.exe
PID 3700 wrote to memory of 3512	3700	56125347cb0694b2893eb25373a1d277756594eaa690fb2cfa4c243361dd8a06.exe	56125347cb0694b2893eb25373a1d277756594eaa690fb2cfa4c243361dd8a06.exe
PID 3700 wrote to memory of 3512	3700	56125347cb0694b2893eb25373a1d277756594eaa690fb2cfa4c243361dd8a06.exe	56125347cb0694b2893eb25373a1d277756594eaa690fb2cfa4c243361dd8a06.exe
PID 3700 wrote to memory of 3512	3700	56125347cb0694b2893eb25373a1d277756594eaa690fb2cfa4c243361dd8a06.exe	56125347cb0694b2893eb25373a1d277756594eaa690fb2cfa4c243361dd8a06.exe

C:\Users\Admin\AppData\Local\Temp\56125347cb0694b2893eb25373a1d277756594eaa690fb2cfa4c243361dd8a06.exe
"C:\Users\Admin\AppData\Local\Temp\56125347cb0694b2893eb25373a1d277756594eaa690fb2cfa4c243361dd8a06.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3700

C:\Users\Admin\AppData\Local\Temp\56125347cb0694b2893eb25373a1d277756594eaa690fb2cfa4c243361dd8a06.exe
start
2⤵
PID:3248

C:\Users\Admin\AppData\Local\Temp\56125347cb0694b2893eb25373a1d277756594eaa690fb2cfa4c243361dd8a06.exe
watch
2⤵
PID:3512

memory/3248-133-0x0000000000000000-mapping.dmp

Download
memory/3248-136-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3248-137-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3248-138-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3512-132-0x0000000000000000-mapping.dmp

Download
memory/3512-135-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3512-139-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3700-134-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download