72fab28ebe1592e00f6edd632c172383ee60a6e650d179ccd00304078ae8bd61

Analysis

max time kernel
375s
max time network
402s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2022, 19:09

Target

72fab28ebe1592e00f6edd632c172383ee60a6e650d179ccd00304078ae8bd61.exe
Size

472KB
MD5

b4b8733654e23590aeea2d7a5d327190
SHA1

97fe92f4b03f8c7bc436317d3e459bb8b96403e9
SHA256

72fab28ebe1592e00f6edd632c172383ee60a6e650d179ccd00304078ae8bd61
SHA512

7971197df664735c25e3aa15b5c7190b931b82968ff63f1c58ac786872863243d3de0687e7b1a3aaca34640ba4af107b319e860aae0d059ea92e181ce5a602f1
SSDEEP

6144:vOVxgn0ZiwYhwU7//cvXdtbGZaklF5aEny0GH9ClBVKy3PH4CNb4PCN39d4W+Rt1:vOvy0VNvnsaiF5CHW3v4g46ND4WGUgb

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3468 wrote to memory of 4200	3468	72fab28ebe1592e00f6edd632c172383ee60a6e650d179ccd00304078ae8bd61.exe	78
PID 3468 wrote to memory of 4200	3468	72fab28ebe1592e00f6edd632c172383ee60a6e650d179ccd00304078ae8bd61.exe	78
PID 3468 wrote to memory of 4200	3468	72fab28ebe1592e00f6edd632c172383ee60a6e650d179ccd00304078ae8bd61.exe	78
PID 3468 wrote to memory of 4652	3468	72fab28ebe1592e00f6edd632c172383ee60a6e650d179ccd00304078ae8bd61.exe	79
PID 3468 wrote to memory of 4652	3468	72fab28ebe1592e00f6edd632c172383ee60a6e650d179ccd00304078ae8bd61.exe	79
PID 3468 wrote to memory of 4652	3468	72fab28ebe1592e00f6edd632c172383ee60a6e650d179ccd00304078ae8bd61.exe	79

C:\Users\Admin\AppData\Local\Temp\72fab28ebe1592e00f6edd632c172383ee60a6e650d179ccd00304078ae8bd61.exe
"C:\Users\Admin\AppData\Local\Temp\72fab28ebe1592e00f6edd632c172383ee60a6e650d179ccd00304078ae8bd61.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Users\Admin\AppData\Local\Temp\72fab28ebe1592e00f6edd632c172383ee60a6e650d179ccd00304078ae8bd61.exe
  start
  2⤵
  PID:4200
- C:\Users\Admin\AppData\Local\Temp\72fab28ebe1592e00f6edd632c172383ee60a6e650d179ccd00304078ae8bd61.exe
  watch
  2⤵
  PID:4652

memory/3468-134-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4200-135-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4200-137-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4652-136-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4652-138-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download