cf8d758b6088798069ab75afad2ecaa5416770cc3c291c8f14a91fba6a29fd0e

Analysis

max time kernel
137s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 15:52

Target

cf8d758b6088798069ab75afad2ecaa5416770cc3c291c8f14a91fba6a29fd0e.exe
Size

522KB
MD5

9a938957bb79537dcf03f4e793ecc4ed
SHA1

7bc2b4b1afd6300edaead34b05128a963b36d330
SHA256

cf8d758b6088798069ab75afad2ecaa5416770cc3c291c8f14a91fba6a29fd0e
SHA512

c010dd6615392bcf9506afe5f76c5611d390dbf816f8824ea3a619fbbbc340b1334df8305a27e10778b8ba79e3da9a851dada41ea64abc47e619f0f9bb73bce8
SSDEEP

12288:ibQCeCG7XAURvgWFvLby18xQqpx8O53n:ibQCeCG7Pvnbatqpx88

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

cf8d758b6088798069ab75afad2ecaa5416770cc3c291c8f14a91fba6a29fd0e.exe

description	pid	process	target process
PID 3156 wrote to memory of 1392	3156	cf8d758b6088798069ab75afad2ecaa5416770cc3c291c8f14a91fba6a29fd0e.exe	cf8d758b6088798069ab75afad2ecaa5416770cc3c291c8f14a91fba6a29fd0e.exe
PID 3156 wrote to memory of 1392	3156	cf8d758b6088798069ab75afad2ecaa5416770cc3c291c8f14a91fba6a29fd0e.exe	cf8d758b6088798069ab75afad2ecaa5416770cc3c291c8f14a91fba6a29fd0e.exe
PID 3156 wrote to memory of 1392	3156	cf8d758b6088798069ab75afad2ecaa5416770cc3c291c8f14a91fba6a29fd0e.exe	cf8d758b6088798069ab75afad2ecaa5416770cc3c291c8f14a91fba6a29fd0e.exe
PID 3156 wrote to memory of 4640	3156	cf8d758b6088798069ab75afad2ecaa5416770cc3c291c8f14a91fba6a29fd0e.exe	cf8d758b6088798069ab75afad2ecaa5416770cc3c291c8f14a91fba6a29fd0e.exe
PID 3156 wrote to memory of 4640	3156	cf8d758b6088798069ab75afad2ecaa5416770cc3c291c8f14a91fba6a29fd0e.exe	cf8d758b6088798069ab75afad2ecaa5416770cc3c291c8f14a91fba6a29fd0e.exe
PID 3156 wrote to memory of 4640	3156	cf8d758b6088798069ab75afad2ecaa5416770cc3c291c8f14a91fba6a29fd0e.exe	cf8d758b6088798069ab75afad2ecaa5416770cc3c291c8f14a91fba6a29fd0e.exe

C:\Users\Admin\AppData\Local\Temp\cf8d758b6088798069ab75afad2ecaa5416770cc3c291c8f14a91fba6a29fd0e.exe
"C:\Users\Admin\AppData\Local\Temp\cf8d758b6088798069ab75afad2ecaa5416770cc3c291c8f14a91fba6a29fd0e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3156

C:\Users\Admin\AppData\Local\Temp\cf8d758b6088798069ab75afad2ecaa5416770cc3c291c8f14a91fba6a29fd0e.exe
start
2⤵
PID:1392

C:\Users\Admin\AppData\Local\Temp\cf8d758b6088798069ab75afad2ecaa5416770cc3c291c8f14a91fba6a29fd0e.exe
watch
2⤵
PID:4640

memory/1392-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1392-144-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1392-134-0x0000000000000000-mapping.dmp

Download
memory/1392-143-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1392-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1392-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3156-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3156-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4640-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4640-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4640-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4640-142-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4640-133-0x0000000000000000-mapping.dmp

Download
memory/4640-145-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download