93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1

Analysis

max time kernel
150s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 07:41

Target

93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe
Size

522KB
MD5

0a7c1f6fd76890bb32224fab899dd5a2
SHA1

20173dc0a7d06f0464cd9a03eb673110200bd69e
SHA256

93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1
SHA512

f5eb187722159bf7bbff4a1016e7742464eaac121d8df0669821db0de6be3752917624df3c6840796eff8702580f24d38a881ed7511def48677324435ec22e32
SSDEEP

6144:+hTpRf3WL0qRXLqNCEtiEjpiKdCvCIUcmDS40s4xRmQy1CrxQqD9RSaSz+8O5gHd:wmL9fuvjQKpIU5GdsIjy18xQqpx8O5g

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe

description	pid	process	target process
PID 4952 wrote to memory of 3972	4952	93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe	93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe
PID 4952 wrote to memory of 3972	4952	93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe	93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe
PID 4952 wrote to memory of 3972	4952	93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe	93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe
PID 4952 wrote to memory of 4092	4952	93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe	93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe
PID 4952 wrote to memory of 4092	4952	93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe	93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe
PID 4952 wrote to memory of 4092	4952	93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe	93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe

C:\Users\Admin\AppData\Local\Temp\93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe
"C:\Users\Admin\AppData\Local\Temp\93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4952

C:\Users\Admin\AppData\Local\Temp\93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe
start
2⤵
PID:3972

C:\Users\Admin\AppData\Local\Temp\93a9abf9838e377f538e26270ac75b10bd791924d51d4f53702cc572c19e0fd1.exe
watch
2⤵
PID:4092

memory/3972-135-0x0000000000000000-mapping.dmp

Download
memory/3972-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3972-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3972-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4092-134-0x0000000000000000-mapping.dmp

Download
memory/4092-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4092-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4092-142-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4952-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4952-133-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4952-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download