6a0518f244f08fbccf6320bc56d45e4274614145b7ba10c4cc70a6a5c3883d8c

Analysis

max time kernel
96s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 07:44

Target

6a0518f244f08fbccf6320bc56d45e4274614145b7ba10c4cc70a6a5c3883d8c.exe
Size

547KB
MD5

df5002b143bd7a4630eaf678a5cb9ea4
SHA1

8d21dacc12976fb9fb1bc2de7a1e71ebfee16c36
SHA256

6a0518f244f08fbccf6320bc56d45e4274614145b7ba10c4cc70a6a5c3883d8c
SHA512

b3b1cc0bd1ecb56fd47c6e52fb4434900e1cb8720d69e6b34e98715e1643f804565608a12b33e00f2f6b725f0d1effbbcf1dfd752c2db6ac70b50e54ef9eaab1
SSDEEP

12288:SIMpMHh1OdD65VMN5YMdhwJ8dW58qjn3j:vDh1O4VM3YMdhwGdWf3j

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

6a0518f244f08fbccf6320bc56d45e4274614145b7ba10c4cc70a6a5c3883d8c.exe

description	pid	process	target process
PID 4788 wrote to memory of 4652	4788	6a0518f244f08fbccf6320bc56d45e4274614145b7ba10c4cc70a6a5c3883d8c.exe	6a0518f244f08fbccf6320bc56d45e4274614145b7ba10c4cc70a6a5c3883d8c.exe
PID 4788 wrote to memory of 4652	4788	6a0518f244f08fbccf6320bc56d45e4274614145b7ba10c4cc70a6a5c3883d8c.exe	6a0518f244f08fbccf6320bc56d45e4274614145b7ba10c4cc70a6a5c3883d8c.exe
PID 4788 wrote to memory of 4652	4788	6a0518f244f08fbccf6320bc56d45e4274614145b7ba10c4cc70a6a5c3883d8c.exe	6a0518f244f08fbccf6320bc56d45e4274614145b7ba10c4cc70a6a5c3883d8c.exe
PID 4788 wrote to memory of 2100	4788	6a0518f244f08fbccf6320bc56d45e4274614145b7ba10c4cc70a6a5c3883d8c.exe	6a0518f244f08fbccf6320bc56d45e4274614145b7ba10c4cc70a6a5c3883d8c.exe
PID 4788 wrote to memory of 2100	4788	6a0518f244f08fbccf6320bc56d45e4274614145b7ba10c4cc70a6a5c3883d8c.exe	6a0518f244f08fbccf6320bc56d45e4274614145b7ba10c4cc70a6a5c3883d8c.exe
PID 4788 wrote to memory of 2100	4788	6a0518f244f08fbccf6320bc56d45e4274614145b7ba10c4cc70a6a5c3883d8c.exe	6a0518f244f08fbccf6320bc56d45e4274614145b7ba10c4cc70a6a5c3883d8c.exe

C:\Users\Admin\AppData\Local\Temp\6a0518f244f08fbccf6320bc56d45e4274614145b7ba10c4cc70a6a5c3883d8c.exe
"C:\Users\Admin\AppData\Local\Temp\6a0518f244f08fbccf6320bc56d45e4274614145b7ba10c4cc70a6a5c3883d8c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4788

C:\Users\Admin\AppData\Local\Temp\6a0518f244f08fbccf6320bc56d45e4274614145b7ba10c4cc70a6a5c3883d8c.exe
start
2⤵
PID:4652

C:\Users\Admin\AppData\Local\Temp\6a0518f244f08fbccf6320bc56d45e4274614145b7ba10c4cc70a6a5c3883d8c.exe
watch
2⤵
PID:2100

memory/2100-134-0x0000000000000000-mapping.dmp

Download
memory/2100-136-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2100-139-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/4652-133-0x0000000000000000-mapping.dmp

Download
memory/4652-137-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/4652-138-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/4788-132-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/4788-135-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download