b5d99bc729dab3c24d4c1768e1d6589332cab5a134a4a6eb89f5e17f1a8c7737

Analysis

max time kernel
201s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 07:38

Target

b5d99bc729dab3c24d4c1768e1d6589332cab5a134a4a6eb89f5e17f1a8c7737.exe
Size

518KB
MD5

4b578b8eb1d37f60cae00607d01cfc4f
SHA1

dc6a30eb88899b63e8b54c497b6272a95a2a29b3
SHA256

b5d99bc729dab3c24d4c1768e1d6589332cab5a134a4a6eb89f5e17f1a8c7737
SHA512

2e77e2fba22775c304111d4938a7944398c8e6e0cbf4f9e61910e7fa082258b5f4be50dd8325d5e93517b57a8b4e1f7a99d1b7b418ed1dd1bcef31ce207fa69c
SSDEEP

6144:uD1Vk0u/l0dCr2T2mDEWiWdAnheC7tWQXNile8Rrlw75G9+lLPX9MM8e459KOoWH:S1VtuSAr2JPix72wYYlLPt5oKnWq3yb

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

b5d99bc729dab3c24d4c1768e1d6589332cab5a134a4a6eb89f5e17f1a8c7737.exe

description	pid	process	target process
PID 3792 wrote to memory of 2520	3792	b5d99bc729dab3c24d4c1768e1d6589332cab5a134a4a6eb89f5e17f1a8c7737.exe	b5d99bc729dab3c24d4c1768e1d6589332cab5a134a4a6eb89f5e17f1a8c7737.exe
PID 3792 wrote to memory of 2520	3792	b5d99bc729dab3c24d4c1768e1d6589332cab5a134a4a6eb89f5e17f1a8c7737.exe	b5d99bc729dab3c24d4c1768e1d6589332cab5a134a4a6eb89f5e17f1a8c7737.exe
PID 3792 wrote to memory of 2520	3792	b5d99bc729dab3c24d4c1768e1d6589332cab5a134a4a6eb89f5e17f1a8c7737.exe	b5d99bc729dab3c24d4c1768e1d6589332cab5a134a4a6eb89f5e17f1a8c7737.exe
PID 3792 wrote to memory of 3804	3792	b5d99bc729dab3c24d4c1768e1d6589332cab5a134a4a6eb89f5e17f1a8c7737.exe	b5d99bc729dab3c24d4c1768e1d6589332cab5a134a4a6eb89f5e17f1a8c7737.exe
PID 3792 wrote to memory of 3804	3792	b5d99bc729dab3c24d4c1768e1d6589332cab5a134a4a6eb89f5e17f1a8c7737.exe	b5d99bc729dab3c24d4c1768e1d6589332cab5a134a4a6eb89f5e17f1a8c7737.exe
PID 3792 wrote to memory of 3804	3792	b5d99bc729dab3c24d4c1768e1d6589332cab5a134a4a6eb89f5e17f1a8c7737.exe	b5d99bc729dab3c24d4c1768e1d6589332cab5a134a4a6eb89f5e17f1a8c7737.exe

C:\Users\Admin\AppData\Local\Temp\b5d99bc729dab3c24d4c1768e1d6589332cab5a134a4a6eb89f5e17f1a8c7737.exe
"C:\Users\Admin\AppData\Local\Temp\b5d99bc729dab3c24d4c1768e1d6589332cab5a134a4a6eb89f5e17f1a8c7737.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3792

C:\Users\Admin\AppData\Local\Temp\b5d99bc729dab3c24d4c1768e1d6589332cab5a134a4a6eb89f5e17f1a8c7737.exe
start
2⤵
PID:2520

C:\Users\Admin\AppData\Local\Temp\b5d99bc729dab3c24d4c1768e1d6589332cab5a134a4a6eb89f5e17f1a8c7737.exe
watch
2⤵
PID:3804

memory/2520-134-0x0000000000000000-mapping.dmp

Download
memory/2520-137-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2520-139-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2520-140-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3792-132-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3792-135-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3804-133-0x0000000000000000-mapping.dmp

Download
memory/3804-136-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3804-138-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3804-141-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download