90d5d1a2e7d87b6a01c5c2a8858a61ad141a9a6c8b993823a57c5dd525e518e2

Analysis

max time kernel
135s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 07:41

Target

90d5d1a2e7d87b6a01c5c2a8858a61ad141a9a6c8b993823a57c5dd525e518e2.exe
Size

547KB
MD5

e3df27247e1f39bbf236e4c0be02f3c9
SHA1

4ec428bbea1273f2204d738048fbe78e93fe9fe1
SHA256

90d5d1a2e7d87b6a01c5c2a8858a61ad141a9a6c8b993823a57c5dd525e518e2
SHA512

25461ac144f1fe733da2b6acb75f90744dc8d4323b689916600a91cb45595cd5e9a0aa726173a9169fc93eb4507be09378515c89f2a261cd794e6f402a6e94e1
SSDEEP

12288:i7CqtFtOYruzYd0pVj768gsz5YMdhwJ8dW58XNn3L:kJBOY4Yan/XYMdhwGdWi3L

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

90d5d1a2e7d87b6a01c5c2a8858a61ad141a9a6c8b993823a57c5dd525e518e2.exe

description	pid	process	target process
PID 2156 wrote to memory of 4976	2156	90d5d1a2e7d87b6a01c5c2a8858a61ad141a9a6c8b993823a57c5dd525e518e2.exe	90d5d1a2e7d87b6a01c5c2a8858a61ad141a9a6c8b993823a57c5dd525e518e2.exe
PID 2156 wrote to memory of 4976	2156	90d5d1a2e7d87b6a01c5c2a8858a61ad141a9a6c8b993823a57c5dd525e518e2.exe	90d5d1a2e7d87b6a01c5c2a8858a61ad141a9a6c8b993823a57c5dd525e518e2.exe
PID 2156 wrote to memory of 4976	2156	90d5d1a2e7d87b6a01c5c2a8858a61ad141a9a6c8b993823a57c5dd525e518e2.exe	90d5d1a2e7d87b6a01c5c2a8858a61ad141a9a6c8b993823a57c5dd525e518e2.exe
PID 2156 wrote to memory of 4884	2156	90d5d1a2e7d87b6a01c5c2a8858a61ad141a9a6c8b993823a57c5dd525e518e2.exe	90d5d1a2e7d87b6a01c5c2a8858a61ad141a9a6c8b993823a57c5dd525e518e2.exe
PID 2156 wrote to memory of 4884	2156	90d5d1a2e7d87b6a01c5c2a8858a61ad141a9a6c8b993823a57c5dd525e518e2.exe	90d5d1a2e7d87b6a01c5c2a8858a61ad141a9a6c8b993823a57c5dd525e518e2.exe
PID 2156 wrote to memory of 4884	2156	90d5d1a2e7d87b6a01c5c2a8858a61ad141a9a6c8b993823a57c5dd525e518e2.exe	90d5d1a2e7d87b6a01c5c2a8858a61ad141a9a6c8b993823a57c5dd525e518e2.exe

C:\Users\Admin\AppData\Local\Temp\90d5d1a2e7d87b6a01c5c2a8858a61ad141a9a6c8b993823a57c5dd525e518e2.exe
"C:\Users\Admin\AppData\Local\Temp\90d5d1a2e7d87b6a01c5c2a8858a61ad141a9a6c8b993823a57c5dd525e518e2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2156

C:\Users\Admin\AppData\Local\Temp\90d5d1a2e7d87b6a01c5c2a8858a61ad141a9a6c8b993823a57c5dd525e518e2.exe
start
2⤵
PID:4976

C:\Users\Admin\AppData\Local\Temp\90d5d1a2e7d87b6a01c5c2a8858a61ad141a9a6c8b993823a57c5dd525e518e2.exe
watch
2⤵
PID:4884

memory/2156-135-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2156-138-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/4884-137-0x0000000000000000-mapping.dmp

Download
memory/4884-140-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/4884-142-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/4884-143-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/4976-136-0x0000000000000000-mapping.dmp

Download
memory/4976-139-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/4976-141-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download