e58ddff5875e256e2e817676954a161a9a7d8a3e9f877e622d5fb85c7d94bbb4

Analysis

max time kernel
292s
max time network
308s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 15:38

Target

e58ddff5875e256e2e817676954a161a9a7d8a3e9f877e622d5fb85c7d94bbb4.exe
Size

531KB
MD5

96554ce797353224d21aa50705aadbca
SHA1

4f239d3dc0944c7359ed68b79bc3650beea689a3
SHA256

e58ddff5875e256e2e817676954a161a9a7d8a3e9f877e622d5fb85c7d94bbb4
SHA512

8c4fd0add0c9df7a8edf89c0f2b53c5878a35d165b207f500b9597da3d0e2aaa8557185d3ef7db3117f86275f4b1df0f672cbe316787fe36fae2a6134d9f58a5
SSDEEP

12288:8pAXl299GMoUYxarCM/9O0nBG3+ThJ10mANAwh:1wT0xaOTSIwvTOPh

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

e58ddff5875e256e2e817676954a161a9a7d8a3e9f877e622d5fb85c7d94bbb4.exe

description	pid	process	target process
PID 4776 wrote to memory of 4140	4776	e58ddff5875e256e2e817676954a161a9a7d8a3e9f877e622d5fb85c7d94bbb4.exe	e58ddff5875e256e2e817676954a161a9a7d8a3e9f877e622d5fb85c7d94bbb4.exe
PID 4776 wrote to memory of 4140	4776	e58ddff5875e256e2e817676954a161a9a7d8a3e9f877e622d5fb85c7d94bbb4.exe	e58ddff5875e256e2e817676954a161a9a7d8a3e9f877e622d5fb85c7d94bbb4.exe
PID 4776 wrote to memory of 4140	4776	e58ddff5875e256e2e817676954a161a9a7d8a3e9f877e622d5fb85c7d94bbb4.exe	e58ddff5875e256e2e817676954a161a9a7d8a3e9f877e622d5fb85c7d94bbb4.exe

C:\Users\Admin\AppData\Local\Temp\e58ddff5875e256e2e817676954a161a9a7d8a3e9f877e622d5fb85c7d94bbb4.exe
"C:\Users\Admin\AppData\Local\Temp\e58ddff5875e256e2e817676954a161a9a7d8a3e9f877e622d5fb85c7d94bbb4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Users\Admin\AppData\Local\Temp\e58ddff5875e256e2e817676954a161a9a7d8a3e9f877e622d5fb85c7d94bbb4.exe
  tear
  2⤵
  PID:4140

memory/4140-133-0x0000000000000000-mapping.dmp

Download
memory/4140-135-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4776-132-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4776-134-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download