38f9503166e6931b04b5a6092b48201bfdc94453c444c33521abaee83dda562a

Analysis

max time kernel
188s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:34

Target

38f9503166e6931b04b5a6092b48201bfdc94453c444c33521abaee83dda562a.exe
Size

522KB
MD5

b5711fc464c3f1ca12aa85ba78146299
SHA1

b44bb7c5a9f7bfbceac54e14e2936b4a3039aac7
SHA256

38f9503166e6931b04b5a6092b48201bfdc94453c444c33521abaee83dda562a
SHA512

62c4368d31bb56ef3184d75159c322ed44919ce92ad7498785150d11eed3255a1951bf62fe755e2d6854f04fbb351ad3c28162c6c94dc8b4c0b4545df9269e91
SSDEEP

6144:uVixoawBB59cEE6Up6z684dtjwvDBMX4lqmQy1CrxQqD9RSaSz+8O5ij7W:o8q684dtE6Ayy18xQqpx8O5i3

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

38f9503166e6931b04b5a6092b48201bfdc94453c444c33521abaee83dda562a.exe

description	pid	process	target process
PID 5068 wrote to memory of 2296	5068	38f9503166e6931b04b5a6092b48201bfdc94453c444c33521abaee83dda562a.exe	38f9503166e6931b04b5a6092b48201bfdc94453c444c33521abaee83dda562a.exe
PID 5068 wrote to memory of 2296	5068	38f9503166e6931b04b5a6092b48201bfdc94453c444c33521abaee83dda562a.exe	38f9503166e6931b04b5a6092b48201bfdc94453c444c33521abaee83dda562a.exe
PID 5068 wrote to memory of 2296	5068	38f9503166e6931b04b5a6092b48201bfdc94453c444c33521abaee83dda562a.exe	38f9503166e6931b04b5a6092b48201bfdc94453c444c33521abaee83dda562a.exe
PID 5068 wrote to memory of 5056	5068	38f9503166e6931b04b5a6092b48201bfdc94453c444c33521abaee83dda562a.exe	38f9503166e6931b04b5a6092b48201bfdc94453c444c33521abaee83dda562a.exe
PID 5068 wrote to memory of 5056	5068	38f9503166e6931b04b5a6092b48201bfdc94453c444c33521abaee83dda562a.exe	38f9503166e6931b04b5a6092b48201bfdc94453c444c33521abaee83dda562a.exe
PID 5068 wrote to memory of 5056	5068	38f9503166e6931b04b5a6092b48201bfdc94453c444c33521abaee83dda562a.exe	38f9503166e6931b04b5a6092b48201bfdc94453c444c33521abaee83dda562a.exe

C:\Users\Admin\AppData\Local\Temp\38f9503166e6931b04b5a6092b48201bfdc94453c444c33521abaee83dda562a.exe
"C:\Users\Admin\AppData\Local\Temp\38f9503166e6931b04b5a6092b48201bfdc94453c444c33521abaee83dda562a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5068

C:\Users\Admin\AppData\Local\Temp\38f9503166e6931b04b5a6092b48201bfdc94453c444c33521abaee83dda562a.exe
start
2⤵
PID:2296

C:\Users\Admin\AppData\Local\Temp\38f9503166e6931b04b5a6092b48201bfdc94453c444c33521abaee83dda562a.exe
watch
2⤵
PID:5056

memory/2296-134-0x0000000000000000-mapping.dmp

Download
memory/2296-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2296-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2296-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/5056-133-0x0000000000000000-mapping.dmp

Download
memory/5056-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/5056-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/5056-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/5068-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/5068-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download