3352740981286ec091bd742b4a6e1ebb182e8fb5ddbd379571988399d403a518

Analysis

max time kernel
152s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:38

Target

3352740981286ec091bd742b4a6e1ebb182e8fb5ddbd379571988399d403a518.exe
Size

522KB
MD5

11a47c64a25738a0856b5ad3ea9e51ed
SHA1

25baa13e31af3d4a57be3960ae78d389686e1a48
SHA256

3352740981286ec091bd742b4a6e1ebb182e8fb5ddbd379571988399d403a518
SHA512

586dca7b6c20ce25d81d772e5eec903cc8ef9f1380612874e537dc5526dbaa86eb402abba3353b36b1ee18542d83ba676028eda87bae8afeacbf658466494f9c
SSDEEP

6144:RR9Kw0esRL8SEOHVkfN5VL81YFoEnUrxkR9VM5imQy1CrxQqD9RSaSz+8O50gxe:MDcOHm18+hUqPVM5Ky18xQqpx8O50

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

3352740981286ec091bd742b4a6e1ebb182e8fb5ddbd379571988399d403a518.exe

description	pid	process	target process
PID 100 wrote to memory of 1396	100	3352740981286ec091bd742b4a6e1ebb182e8fb5ddbd379571988399d403a518.exe	3352740981286ec091bd742b4a6e1ebb182e8fb5ddbd379571988399d403a518.exe
PID 100 wrote to memory of 1396	100	3352740981286ec091bd742b4a6e1ebb182e8fb5ddbd379571988399d403a518.exe	3352740981286ec091bd742b4a6e1ebb182e8fb5ddbd379571988399d403a518.exe
PID 100 wrote to memory of 1396	100	3352740981286ec091bd742b4a6e1ebb182e8fb5ddbd379571988399d403a518.exe	3352740981286ec091bd742b4a6e1ebb182e8fb5ddbd379571988399d403a518.exe
PID 100 wrote to memory of 4084	100	3352740981286ec091bd742b4a6e1ebb182e8fb5ddbd379571988399d403a518.exe	3352740981286ec091bd742b4a6e1ebb182e8fb5ddbd379571988399d403a518.exe
PID 100 wrote to memory of 4084	100	3352740981286ec091bd742b4a6e1ebb182e8fb5ddbd379571988399d403a518.exe	3352740981286ec091bd742b4a6e1ebb182e8fb5ddbd379571988399d403a518.exe
PID 100 wrote to memory of 4084	100	3352740981286ec091bd742b4a6e1ebb182e8fb5ddbd379571988399d403a518.exe	3352740981286ec091bd742b4a6e1ebb182e8fb5ddbd379571988399d403a518.exe

C:\Users\Admin\AppData\Local\Temp\3352740981286ec091bd742b4a6e1ebb182e8fb5ddbd379571988399d403a518.exe
"C:\Users\Admin\AppData\Local\Temp\3352740981286ec091bd742b4a6e1ebb182e8fb5ddbd379571988399d403a518.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:100

C:\Users\Admin\AppData\Local\Temp\3352740981286ec091bd742b4a6e1ebb182e8fb5ddbd379571988399d403a518.exe
start
2⤵
PID:1396

C:\Users\Admin\AppData\Local\Temp\3352740981286ec091bd742b4a6e1ebb182e8fb5ddbd379571988399d403a518.exe
watch
2⤵
PID:4084

memory/100-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/100-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1396-134-0x0000000000000000-mapping.dmp

Download
memory/1396-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1396-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1396-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1396-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1396-142-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4084-133-0x0000000000000000-mapping.dmp

Download
memory/4084-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4084-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4084-143-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download