3ca96dbc811f1f74f829faec3e358a0659f93f09e43f1d49f8ef198dcfca8655

Analysis

max time kernel
380s
max time network
475s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:32

Target

3ca96dbc811f1f74f829faec3e358a0659f93f09e43f1d49f8ef198dcfca8655.exe
Size

522KB
MD5

7eaeb46764e7585a4e8922dfedf1051b
SHA1

50fc2c28b11b6b8530d81e529aefce17eecab721
SHA256

3ca96dbc811f1f74f829faec3e358a0659f93f09e43f1d49f8ef198dcfca8655
SHA512

b7af656609a85e196529db8045f3fc40855004d5932a3ed8ca5101bddff3b35a37581f9d1a455f2d9fd053c952cdd1adbf5739ee1ea9ff80c9b55a74f7c1b17c
SSDEEP

12288:E+ZzYk3cFK+t0MwKRVOXy18xQqpx8O5mQ:FCXWURVOatqpx8e

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

3ca96dbc811f1f74f829faec3e358a0659f93f09e43f1d49f8ef198dcfca8655.exe

description	pid	process	target process
PID 1464 wrote to memory of 4756	1464	3ca96dbc811f1f74f829faec3e358a0659f93f09e43f1d49f8ef198dcfca8655.exe	3ca96dbc811f1f74f829faec3e358a0659f93f09e43f1d49f8ef198dcfca8655.exe
PID 1464 wrote to memory of 4756	1464	3ca96dbc811f1f74f829faec3e358a0659f93f09e43f1d49f8ef198dcfca8655.exe	3ca96dbc811f1f74f829faec3e358a0659f93f09e43f1d49f8ef198dcfca8655.exe
PID 1464 wrote to memory of 4756	1464	3ca96dbc811f1f74f829faec3e358a0659f93f09e43f1d49f8ef198dcfca8655.exe	3ca96dbc811f1f74f829faec3e358a0659f93f09e43f1d49f8ef198dcfca8655.exe
PID 1464 wrote to memory of 1312	1464	3ca96dbc811f1f74f829faec3e358a0659f93f09e43f1d49f8ef198dcfca8655.exe	3ca96dbc811f1f74f829faec3e358a0659f93f09e43f1d49f8ef198dcfca8655.exe
PID 1464 wrote to memory of 1312	1464	3ca96dbc811f1f74f829faec3e358a0659f93f09e43f1d49f8ef198dcfca8655.exe	3ca96dbc811f1f74f829faec3e358a0659f93f09e43f1d49f8ef198dcfca8655.exe
PID 1464 wrote to memory of 1312	1464	3ca96dbc811f1f74f829faec3e358a0659f93f09e43f1d49f8ef198dcfca8655.exe	3ca96dbc811f1f74f829faec3e358a0659f93f09e43f1d49f8ef198dcfca8655.exe

C:\Users\Admin\AppData\Local\Temp\3ca96dbc811f1f74f829faec3e358a0659f93f09e43f1d49f8ef198dcfca8655.exe
"C:\Users\Admin\AppData\Local\Temp\3ca96dbc811f1f74f829faec3e358a0659f93f09e43f1d49f8ef198dcfca8655.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Users\Admin\AppData\Local\Temp\3ca96dbc811f1f74f829faec3e358a0659f93f09e43f1d49f8ef198dcfca8655.exe
  start
  2⤵
  PID:4756
- C:\Users\Admin\AppData\Local\Temp\3ca96dbc811f1f74f829faec3e358a0659f93f09e43f1d49f8ef198dcfca8655.exe
  watch
  2⤵
  PID:1312

memory/1312-134-0x0000000000000000-mapping.dmp

Download
memory/1312-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1312-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1312-142-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1464-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1464-133-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1464-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4756-135-0x0000000000000000-mapping.dmp

Download
memory/4756-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4756-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4756-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download