4bd2aaa918c234f765bc4f27541924979affe98b0f5632010cd277eaeeb10531

Analysis

max time kernel
145s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:23

Target

4bd2aaa918c234f765bc4f27541924979affe98b0f5632010cd277eaeeb10531.exe
Size

521KB
MD5

94fbedbfa59dfacc50025425799f25ab
SHA1

ec87b73487ad751a11e647eb4af492352feef8fd
SHA256

4bd2aaa918c234f765bc4f27541924979affe98b0f5632010cd277eaeeb10531
SHA512

19a9a5c7d28c41da90f22b41fb827bf056e8c0c5c1da63c94bcd1de1e3f11fa744df3a307a2f751e92767b164c39ff1265a2def79ad474ac0a86027a82d8f1b1
SSDEEP

6144:IXvhsk0pjmrlvCbtk1c2PjzOu4nVN/S8Lv3Sg8Gf8yRtD3iBeJQG2XRdNdwJ5au:IXv2jp4vDmuMTMGexGWRLU5

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

4bd2aaa918c234f765bc4f27541924979affe98b0f5632010cd277eaeeb10531.exe

description	pid	process	target process
PID 752 wrote to memory of 3160	752	4bd2aaa918c234f765bc4f27541924979affe98b0f5632010cd277eaeeb10531.exe	4bd2aaa918c234f765bc4f27541924979affe98b0f5632010cd277eaeeb10531.exe
PID 752 wrote to memory of 3160	752	4bd2aaa918c234f765bc4f27541924979affe98b0f5632010cd277eaeeb10531.exe	4bd2aaa918c234f765bc4f27541924979affe98b0f5632010cd277eaeeb10531.exe
PID 752 wrote to memory of 3160	752	4bd2aaa918c234f765bc4f27541924979affe98b0f5632010cd277eaeeb10531.exe	4bd2aaa918c234f765bc4f27541924979affe98b0f5632010cd277eaeeb10531.exe
PID 752 wrote to memory of 964	752	4bd2aaa918c234f765bc4f27541924979affe98b0f5632010cd277eaeeb10531.exe	4bd2aaa918c234f765bc4f27541924979affe98b0f5632010cd277eaeeb10531.exe
PID 752 wrote to memory of 964	752	4bd2aaa918c234f765bc4f27541924979affe98b0f5632010cd277eaeeb10531.exe	4bd2aaa918c234f765bc4f27541924979affe98b0f5632010cd277eaeeb10531.exe
PID 752 wrote to memory of 964	752	4bd2aaa918c234f765bc4f27541924979affe98b0f5632010cd277eaeeb10531.exe	4bd2aaa918c234f765bc4f27541924979affe98b0f5632010cd277eaeeb10531.exe

C:\Users\Admin\AppData\Local\Temp\4bd2aaa918c234f765bc4f27541924979affe98b0f5632010cd277eaeeb10531.exe
"C:\Users\Admin\AppData\Local\Temp\4bd2aaa918c234f765bc4f27541924979affe98b0f5632010cd277eaeeb10531.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:752

C:\Users\Admin\AppData\Local\Temp\4bd2aaa918c234f765bc4f27541924979affe98b0f5632010cd277eaeeb10531.exe
start
2⤵
PID:3160

C:\Users\Admin\AppData\Local\Temp\4bd2aaa918c234f765bc4f27541924979affe98b0f5632010cd277eaeeb10531.exe
watch
2⤵
PID:964

memory/752-134-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/964-132-0x0000000000000000-mapping.dmp

Download
memory/964-135-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/964-138-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3160-133-0x0000000000000000-mapping.dmp

Download
memory/3160-136-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3160-137-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download