6b488fdab3f8d56205ec5af712a3657a9592501c3f0b89a8fcb5834aaacda18f

Analysis

max time kernel
171s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 07:44

Target

6b488fdab3f8d56205ec5af712a3657a9592501c3f0b89a8fcb5834aaacda18f.exe
Size

518KB
MD5

bbd6c848eaad65d705484184f8370d5e
SHA1

b19d52ccc0b9d1125a9c670d44d2de7efc6f63c2
SHA256

6b488fdab3f8d56205ec5af712a3657a9592501c3f0b89a8fcb5834aaacda18f
SHA512

d4160d8b54f0ba44f069d83046c53b77f63b28edd43de9e17e8086813317e34c554fbfb0daa094994358d9b78e9495f6e8f39dcb18a8c27f6088c893f453d660
SSDEEP

12288:FDz5gbs7oFWikREOKZl1wYYlLPt5oKnWq36b:Fv5gbsoF9O0lylLPt5/WH

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

6b488fdab3f8d56205ec5af712a3657a9592501c3f0b89a8fcb5834aaacda18f.exe

description	pid	process	target process
PID 4392 wrote to memory of 3060	4392	6b488fdab3f8d56205ec5af712a3657a9592501c3f0b89a8fcb5834aaacda18f.exe	6b488fdab3f8d56205ec5af712a3657a9592501c3f0b89a8fcb5834aaacda18f.exe
PID 4392 wrote to memory of 3060	4392	6b488fdab3f8d56205ec5af712a3657a9592501c3f0b89a8fcb5834aaacda18f.exe	6b488fdab3f8d56205ec5af712a3657a9592501c3f0b89a8fcb5834aaacda18f.exe
PID 4392 wrote to memory of 3060	4392	6b488fdab3f8d56205ec5af712a3657a9592501c3f0b89a8fcb5834aaacda18f.exe	6b488fdab3f8d56205ec5af712a3657a9592501c3f0b89a8fcb5834aaacda18f.exe
PID 4392 wrote to memory of 5060	4392	6b488fdab3f8d56205ec5af712a3657a9592501c3f0b89a8fcb5834aaacda18f.exe	6b488fdab3f8d56205ec5af712a3657a9592501c3f0b89a8fcb5834aaacda18f.exe
PID 4392 wrote to memory of 5060	4392	6b488fdab3f8d56205ec5af712a3657a9592501c3f0b89a8fcb5834aaacda18f.exe	6b488fdab3f8d56205ec5af712a3657a9592501c3f0b89a8fcb5834aaacda18f.exe
PID 4392 wrote to memory of 5060	4392	6b488fdab3f8d56205ec5af712a3657a9592501c3f0b89a8fcb5834aaacda18f.exe	6b488fdab3f8d56205ec5af712a3657a9592501c3f0b89a8fcb5834aaacda18f.exe

C:\Users\Admin\AppData\Local\Temp\6b488fdab3f8d56205ec5af712a3657a9592501c3f0b89a8fcb5834aaacda18f.exe
"C:\Users\Admin\AppData\Local\Temp\6b488fdab3f8d56205ec5af712a3657a9592501c3f0b89a8fcb5834aaacda18f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4392

C:\Users\Admin\AppData\Local\Temp\6b488fdab3f8d56205ec5af712a3657a9592501c3f0b89a8fcb5834aaacda18f.exe
start
2⤵
PID:3060

C:\Users\Admin\AppData\Local\Temp\6b488fdab3f8d56205ec5af712a3657a9592501c3f0b89a8fcb5834aaacda18f.exe
watch
2⤵
PID:5060

memory/3060-134-0x0000000000000000-mapping.dmp

Download
memory/3060-136-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3060-138-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3060-140-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4392-132-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4392-135-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/5060-133-0x0000000000000000-mapping.dmp

Download
memory/5060-137-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/5060-139-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/5060-141-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download