416d79f7054dfd5867f49852aa2962e086f78d5e68eb708c4051b046993143b2

Analysis

max time kernel
179s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:30

Target

416d79f7054dfd5867f49852aa2962e086f78d5e68eb708c4051b046993143b2.exe
Size

533KB
MD5

d1054f2e96c1a5d904067b31c58ef265
SHA1

5a617c2984c26daebe65ecfaaf47cb8577b8cd44
SHA256

416d79f7054dfd5867f49852aa2962e086f78d5e68eb708c4051b046993143b2
SHA512

0988fe563187cf03eded468d5fb20960c85461a440cb060d6cdc8c26f2fd201df78682330a9e091d133d599c8cd332dc40153454233499a80f317be439cf454e
SSDEEP

12288:vkzraJAY0hEzyJr6Zunx0GLM5ChzQ1RVykcjY:vIqzsx0GLrh01jyL0

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

416d79f7054dfd5867f49852aa2962e086f78d5e68eb708c4051b046993143b2.exe

description	pid	process	target process
PID 4380 wrote to memory of 5032	4380	416d79f7054dfd5867f49852aa2962e086f78d5e68eb708c4051b046993143b2.exe	416d79f7054dfd5867f49852aa2962e086f78d5e68eb708c4051b046993143b2.exe
PID 4380 wrote to memory of 5032	4380	416d79f7054dfd5867f49852aa2962e086f78d5e68eb708c4051b046993143b2.exe	416d79f7054dfd5867f49852aa2962e086f78d5e68eb708c4051b046993143b2.exe
PID 4380 wrote to memory of 5032	4380	416d79f7054dfd5867f49852aa2962e086f78d5e68eb708c4051b046993143b2.exe	416d79f7054dfd5867f49852aa2962e086f78d5e68eb708c4051b046993143b2.exe

C:\Users\Admin\AppData\Local\Temp\416d79f7054dfd5867f49852aa2962e086f78d5e68eb708c4051b046993143b2.exe
"C:\Users\Admin\AppData\Local\Temp\416d79f7054dfd5867f49852aa2962e086f78d5e68eb708c4051b046993143b2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4380

C:\Users\Admin\AppData\Local\Temp\416d79f7054dfd5867f49852aa2962e086f78d5e68eb708c4051b046993143b2.exe
tear
2⤵
PID:5032

memory/4380-132-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4380-134-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/5032-133-0x0000000000000000-mapping.dmp

Download
memory/5032-135-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/5032-136-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/5032-137-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/5032-138-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download