e5e4079e309cbd81af7edf3f8b277de2d4b71a21f3a31100866273cb76763b82

Analysis

max time kernel
136s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 15:37

Target

e5e4079e309cbd81af7edf3f8b277de2d4b71a21f3a31100866273cb76763b82.exe
Size

533KB
MD5

3d759348e54fe90175d449fef1d60844
SHA1

c4a163e7c62613180e806de91584a25f755ce4f0
SHA256

e5e4079e309cbd81af7edf3f8b277de2d4b71a21f3a31100866273cb76763b82
SHA512

38c4c9b09284f5b9fffb6f0609f804aed242e0679ac0355b7f848d0507076195618ac470d04f54b014cc1a7e8f97aed63969aa2f56cf3489982f2406a737aeac
SSDEEP

6144:gNaTohk8bhOkQDjJRHJszEDeU0nebQn2e38yfA8tzk3ze9ts45wtL4vt0Hb3LLWR:gkidhOZPfCtoHydt0zYWoWL0+fJgv0c

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

e5e4079e309cbd81af7edf3f8b277de2d4b71a21f3a31100866273cb76763b82.exe

description	pid	process	target process
PID 3952 wrote to memory of 2988	3952	e5e4079e309cbd81af7edf3f8b277de2d4b71a21f3a31100866273cb76763b82.exe	e5e4079e309cbd81af7edf3f8b277de2d4b71a21f3a31100866273cb76763b82.exe
PID 3952 wrote to memory of 2988	3952	e5e4079e309cbd81af7edf3f8b277de2d4b71a21f3a31100866273cb76763b82.exe	e5e4079e309cbd81af7edf3f8b277de2d4b71a21f3a31100866273cb76763b82.exe
PID 3952 wrote to memory of 2988	3952	e5e4079e309cbd81af7edf3f8b277de2d4b71a21f3a31100866273cb76763b82.exe	e5e4079e309cbd81af7edf3f8b277de2d4b71a21f3a31100866273cb76763b82.exe
PID 3952 wrote to memory of 1428	3952	e5e4079e309cbd81af7edf3f8b277de2d4b71a21f3a31100866273cb76763b82.exe	e5e4079e309cbd81af7edf3f8b277de2d4b71a21f3a31100866273cb76763b82.exe
PID 3952 wrote to memory of 1428	3952	e5e4079e309cbd81af7edf3f8b277de2d4b71a21f3a31100866273cb76763b82.exe	e5e4079e309cbd81af7edf3f8b277de2d4b71a21f3a31100866273cb76763b82.exe
PID 3952 wrote to memory of 1428	3952	e5e4079e309cbd81af7edf3f8b277de2d4b71a21f3a31100866273cb76763b82.exe	e5e4079e309cbd81af7edf3f8b277de2d4b71a21f3a31100866273cb76763b82.exe

C:\Users\Admin\AppData\Local\Temp\e5e4079e309cbd81af7edf3f8b277de2d4b71a21f3a31100866273cb76763b82.exe
"C:\Users\Admin\AppData\Local\Temp\e5e4079e309cbd81af7edf3f8b277de2d4b71a21f3a31100866273cb76763b82.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Users\Admin\AppData\Local\Temp\e5e4079e309cbd81af7edf3f8b277de2d4b71a21f3a31100866273cb76763b82.exe
  start
  2⤵
  PID:2988
- C:\Users\Admin\AppData\Local\Temp\e5e4079e309cbd81af7edf3f8b277de2d4b71a21f3a31100866273cb76763b82.exe
  watch
  2⤵
  PID:1428

memory/1428-133-0x0000000000000000-mapping.dmp

Download
memory/1428-136-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/1428-138-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/1428-142-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/2988-134-0x0000000000000000-mapping.dmp

Download
memory/2988-137-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/2988-139-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/2988-140-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/2988-141-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/3952-132-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/3952-135-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download