ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496

Analysis

max time kernel
112s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 15:34

Target

ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496.exe
Size

537KB
MD5

041e704e2afab9ff442cbbd924b427b3
SHA1

ec451fd24dd2416c98692cab4427db2e2ccfcc9e
SHA256

ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496
SHA512

45a5694df2f6f73e80b9fc9478f45f01febbdc35001c8e92fadfe6f27de2ba710a6dd89fa56a37f8058742cc26922961aa2d54563fc4df80c78f32a70d9885a2
SSDEEP

12288:sdKz4lHD4TxfVPymGPfpyCqi8ka8nmCEJdTye63QmeQ:vz+j4F5yHpXqi8kJcDmeQ

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496.exe

description	pid	process	target process
PID 4884 wrote to memory of 3064	4884	ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496.exe	ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496.exe
PID 4884 wrote to memory of 3064	4884	ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496.exe	ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496.exe
PID 4884 wrote to memory of 3064	4884	ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496.exe	ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496.exe
PID 4884 wrote to memory of 4880	4884	ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496.exe	ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496.exe
PID 4884 wrote to memory of 4880	4884	ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496.exe	ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496.exe
PID 4884 wrote to memory of 4880	4884	ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496.exe	ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496.exe

C:\Users\Admin\AppData\Local\Temp\ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496.exe
"C:\Users\Admin\AppData\Local\Temp\ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Users\Admin\AppData\Local\Temp\ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496.exe
  start
  2⤵
  PID:3064
- C:\Users\Admin\AppData\Local\Temp\ec7c726150c20a4313c796db233e9bf3dbb83a432a34e511941210fab8a7e496.exe
  watch
  2⤵
  PID:4880

memory/3064-132-0x0000000000000000-mapping.dmp

Download
memory/3064-136-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/3064-138-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4880-133-0x0000000000000000-mapping.dmp

Download
memory/4880-135-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4880-137-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4880-139-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4884-134-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download