50a09c8c5ea970472ee8e3d9d7a6bd033c901b183519852b70f492dce0f5ec08

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 07:45

Target

50a09c8c5ea970472ee8e3d9d7a6bd033c901b183519852b70f492dce0f5ec08.exe
Size

529KB
MD5

cdb98d0beb7fd972b50bb21ebd714020
SHA1

da4ed9d551f6fba5e9bad03968aa42cd0855a84a
SHA256

50a09c8c5ea970472ee8e3d9d7a6bd033c901b183519852b70f492dce0f5ec08
SHA512

b2321ccac94d7f613572425a6baf4f52e502832e1bc890f531c63a296b1e8e89510bf4890bcdf7ab3f40a5d6febb17afd590d830802df397dbffd103a97182d5
SSDEEP

6144:JtIvtKRLeU9MH9LJlHmgureLAWHoWQEVj7h2JaA7i62r7ybh+tMLpM0eIUPJuh8C:Jt28RiUCHxJ1AZWQKmFG68PPouPQl

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

50a09c8c5ea970472ee8e3d9d7a6bd033c901b183519852b70f492dce0f5ec08.exe

description	pid	process	target process
PID 1328 wrote to memory of 4900	1328	50a09c8c5ea970472ee8e3d9d7a6bd033c901b183519852b70f492dce0f5ec08.exe	50a09c8c5ea970472ee8e3d9d7a6bd033c901b183519852b70f492dce0f5ec08.exe
PID 1328 wrote to memory of 4900	1328	50a09c8c5ea970472ee8e3d9d7a6bd033c901b183519852b70f492dce0f5ec08.exe	50a09c8c5ea970472ee8e3d9d7a6bd033c901b183519852b70f492dce0f5ec08.exe
PID 1328 wrote to memory of 4900	1328	50a09c8c5ea970472ee8e3d9d7a6bd033c901b183519852b70f492dce0f5ec08.exe	50a09c8c5ea970472ee8e3d9d7a6bd033c901b183519852b70f492dce0f5ec08.exe
PID 1328 wrote to memory of 60	1328	50a09c8c5ea970472ee8e3d9d7a6bd033c901b183519852b70f492dce0f5ec08.exe	50a09c8c5ea970472ee8e3d9d7a6bd033c901b183519852b70f492dce0f5ec08.exe
PID 1328 wrote to memory of 60	1328	50a09c8c5ea970472ee8e3d9d7a6bd033c901b183519852b70f492dce0f5ec08.exe	50a09c8c5ea970472ee8e3d9d7a6bd033c901b183519852b70f492dce0f5ec08.exe
PID 1328 wrote to memory of 60	1328	50a09c8c5ea970472ee8e3d9d7a6bd033c901b183519852b70f492dce0f5ec08.exe	50a09c8c5ea970472ee8e3d9d7a6bd033c901b183519852b70f492dce0f5ec08.exe

C:\Users\Admin\AppData\Local\Temp\50a09c8c5ea970472ee8e3d9d7a6bd033c901b183519852b70f492dce0f5ec08.exe
"C:\Users\Admin\AppData\Local\Temp\50a09c8c5ea970472ee8e3d9d7a6bd033c901b183519852b70f492dce0f5ec08.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1328

C:\Users\Admin\AppData\Local\Temp\50a09c8c5ea970472ee8e3d9d7a6bd033c901b183519852b70f492dce0f5ec08.exe
start
2⤵
PID:4900

C:\Users\Admin\AppData\Local\Temp\50a09c8c5ea970472ee8e3d9d7a6bd033c901b183519852b70f492dce0f5ec08.exe
watch
2⤵
PID:60

memory/60-133-0x0000000000000000-mapping.dmp

Download
memory/60-137-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/60-139-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/60-141-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1328-132-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1328-135-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/4900-134-0x0000000000000000-mapping.dmp

Download
memory/4900-136-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/4900-138-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/4900-140-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download