691db1da310cc4471a06874e0826b6b3e7571c2c59044469923f84016f3318b2

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 16:57

Target

691db1da310cc4471a06874e0826b6b3e7571c2c59044469923f84016f3318b2.exe
Size

518KB
MD5

52f7e0a40d83af41a0a10f2d04986f74
SHA1

a1821ce0c44aa3dde4e2035cfe19ebe4ffeecc07
SHA256

691db1da310cc4471a06874e0826b6b3e7571c2c59044469923f84016f3318b2
SHA512

b3525ab284ed8ab4bcf77a63cc5f5a78499a28adb39f4f2e88776ddeea57e254ac3c769e87ce9e3388e2ca40d11583828103420e00cf17e7079e2956de872ce0
SSDEEP

12288:W5QX1ZT8xOTXSkykTVf3klxpwPUjASES/ya+WJPwTOES/v:WW8xOTXXxBvklxmPuAsz+OPwTvS/

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

691db1da310cc4471a06874e0826b6b3e7571c2c59044469923f84016f3318b2.exe

description	pid	process	target process
PID 1632 wrote to memory of 3056	1632	691db1da310cc4471a06874e0826b6b3e7571c2c59044469923f84016f3318b2.exe	691db1da310cc4471a06874e0826b6b3e7571c2c59044469923f84016f3318b2.exe
PID 1632 wrote to memory of 3056	1632	691db1da310cc4471a06874e0826b6b3e7571c2c59044469923f84016f3318b2.exe	691db1da310cc4471a06874e0826b6b3e7571c2c59044469923f84016f3318b2.exe
PID 1632 wrote to memory of 3056	1632	691db1da310cc4471a06874e0826b6b3e7571c2c59044469923f84016f3318b2.exe	691db1da310cc4471a06874e0826b6b3e7571c2c59044469923f84016f3318b2.exe
PID 1632 wrote to memory of 3304	1632	691db1da310cc4471a06874e0826b6b3e7571c2c59044469923f84016f3318b2.exe	691db1da310cc4471a06874e0826b6b3e7571c2c59044469923f84016f3318b2.exe
PID 1632 wrote to memory of 3304	1632	691db1da310cc4471a06874e0826b6b3e7571c2c59044469923f84016f3318b2.exe	691db1da310cc4471a06874e0826b6b3e7571c2c59044469923f84016f3318b2.exe
PID 1632 wrote to memory of 3304	1632	691db1da310cc4471a06874e0826b6b3e7571c2c59044469923f84016f3318b2.exe	691db1da310cc4471a06874e0826b6b3e7571c2c59044469923f84016f3318b2.exe

C:\Users\Admin\AppData\Local\Temp\691db1da310cc4471a06874e0826b6b3e7571c2c59044469923f84016f3318b2.exe
"C:\Users\Admin\AppData\Local\Temp\691db1da310cc4471a06874e0826b6b3e7571c2c59044469923f84016f3318b2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1632

C:\Users\Admin\AppData\Local\Temp\691db1da310cc4471a06874e0826b6b3e7571c2c59044469923f84016f3318b2.exe
start
2⤵
PID:3056

C:\Users\Admin\AppData\Local\Temp\691db1da310cc4471a06874e0826b6b3e7571c2c59044469923f84016f3318b2.exe
watch
2⤵
PID:3304

memory/1632-134-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3056-133-0x0000000000000000-mapping.dmp

Download
memory/3056-135-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3056-138-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3304-132-0x0000000000000000-mapping.dmp

Download
memory/3304-136-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3304-137-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3304-139-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download