5f8f2ab01aa416352e565b179bc349b7a5ffae127bd85553caccfbee95a8636d

Analysis

max time kernel
353s
max time network
409s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 17:04

Target

5f8f2ab01aa416352e565b179bc349b7a5ffae127bd85553caccfbee95a8636d.exe
Size

533KB
MD5

64b9f161601f09d0a1b90494e78552bf
SHA1

290a1b9035e8f7b277dbbd8ee5023ce587a3d3dd
SHA256

5f8f2ab01aa416352e565b179bc349b7a5ffae127bd85553caccfbee95a8636d
SHA512

f968bc5eac857de3d32eb555783cec23947f71036760a193d7ef9bb8fdebf16b2b3eb5d6a7e6f0313c030d92f6140b80224715349d2b3cce86016a8ea3e3fae5
SSDEEP

6144:ENSuOFUZ34Q6ptL2xbLrjOIbtdXwAgUCsPYVho4eSvqp5CgZu8tL4vt0Hb3LLWFp:EQutc/LCtHJ7AjJKEgPL0+fJgv0A

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

5f8f2ab01aa416352e565b179bc349b7a5ffae127bd85553caccfbee95a8636d.exe

description	pid	process	target process
PID 792 wrote to memory of 4964	792	5f8f2ab01aa416352e565b179bc349b7a5ffae127bd85553caccfbee95a8636d.exe	5f8f2ab01aa416352e565b179bc349b7a5ffae127bd85553caccfbee95a8636d.exe
PID 792 wrote to memory of 4964	792	5f8f2ab01aa416352e565b179bc349b7a5ffae127bd85553caccfbee95a8636d.exe	5f8f2ab01aa416352e565b179bc349b7a5ffae127bd85553caccfbee95a8636d.exe
PID 792 wrote to memory of 4964	792	5f8f2ab01aa416352e565b179bc349b7a5ffae127bd85553caccfbee95a8636d.exe	5f8f2ab01aa416352e565b179bc349b7a5ffae127bd85553caccfbee95a8636d.exe

C:\Users\Admin\AppData\Local\Temp\5f8f2ab01aa416352e565b179bc349b7a5ffae127bd85553caccfbee95a8636d.exe
"C:\Users\Admin\AppData\Local\Temp\5f8f2ab01aa416352e565b179bc349b7a5ffae127bd85553caccfbee95a8636d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:792

C:\Users\Admin\AppData\Local\Temp\5f8f2ab01aa416352e565b179bc349b7a5ffae127bd85553caccfbee95a8636d.exe
start
2⤵
PID:4964

memory/792-132-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download