99a039bb757dee0330544794e8b57f78f018676c2846efb4ef34eb96e9d252ee

Analysis

max time kernel
170s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 07:40

Target

99a039bb757dee0330544794e8b57f78f018676c2846efb4ef34eb96e9d252ee.exe
Size

518KB
MD5

7a4fadea84fa500fefe34880a20355d5
SHA1

e52c61e5c926aaafde97d6acb1db910a7b3f8e04
SHA256

99a039bb757dee0330544794e8b57f78f018676c2846efb4ef34eb96e9d252ee
SHA512

c53cf66d02fb379256b7df70302f8c3363b53c12bd4ebab21a33c5df6be5c310760761312f6ec39308972504efad635b7bf12021e79b47b1b84a52ee63dc8dd0
SSDEEP

6144:xiqwnv2YvhsOecvOeKPvdC3WqvOc2mp5YCQU22Ea/zVLRlw75G9+lLPX9MM8e45j:xY8cCRCdpRwYYlLPt5oKnWq3DVb

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

99a039bb757dee0330544794e8b57f78f018676c2846efb4ef34eb96e9d252ee.exe

description	pid	process	target process
PID 5060 wrote to memory of 3660	5060	99a039bb757dee0330544794e8b57f78f018676c2846efb4ef34eb96e9d252ee.exe	99a039bb757dee0330544794e8b57f78f018676c2846efb4ef34eb96e9d252ee.exe
PID 5060 wrote to memory of 3660	5060	99a039bb757dee0330544794e8b57f78f018676c2846efb4ef34eb96e9d252ee.exe	99a039bb757dee0330544794e8b57f78f018676c2846efb4ef34eb96e9d252ee.exe
PID 5060 wrote to memory of 3660	5060	99a039bb757dee0330544794e8b57f78f018676c2846efb4ef34eb96e9d252ee.exe	99a039bb757dee0330544794e8b57f78f018676c2846efb4ef34eb96e9d252ee.exe
PID 5060 wrote to memory of 3676	5060	99a039bb757dee0330544794e8b57f78f018676c2846efb4ef34eb96e9d252ee.exe	99a039bb757dee0330544794e8b57f78f018676c2846efb4ef34eb96e9d252ee.exe
PID 5060 wrote to memory of 3676	5060	99a039bb757dee0330544794e8b57f78f018676c2846efb4ef34eb96e9d252ee.exe	99a039bb757dee0330544794e8b57f78f018676c2846efb4ef34eb96e9d252ee.exe
PID 5060 wrote to memory of 3676	5060	99a039bb757dee0330544794e8b57f78f018676c2846efb4ef34eb96e9d252ee.exe	99a039bb757dee0330544794e8b57f78f018676c2846efb4ef34eb96e9d252ee.exe

C:\Users\Admin\AppData\Local\Temp\99a039bb757dee0330544794e8b57f78f018676c2846efb4ef34eb96e9d252ee.exe
"C:\Users\Admin\AppData\Local\Temp\99a039bb757dee0330544794e8b57f78f018676c2846efb4ef34eb96e9d252ee.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5060

C:\Users\Admin\AppData\Local\Temp\99a039bb757dee0330544794e8b57f78f018676c2846efb4ef34eb96e9d252ee.exe
start
2⤵
PID:3660

C:\Users\Admin\AppData\Local\Temp\99a039bb757dee0330544794e8b57f78f018676c2846efb4ef34eb96e9d252ee.exe
watch
2⤵
PID:3676

memory/3660-135-0x0000000000000000-mapping.dmp

Download
memory/3660-137-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3660-140-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3660-141-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3676-134-0x0000000000000000-mapping.dmp

Download
memory/3676-138-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3676-139-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3676-142-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/5060-132-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/5060-133-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/5060-136-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download