3b2ae0ebcc161123fe400511c2a715d23b6f37915aba534d865643959286a2f0

Analysis

max time kernel
187s
max time network
196s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 07:48

Target

3b2ae0ebcc161123fe400511c2a715d23b6f37915aba534d865643959286a2f0.exe
Size

547KB
MD5

5b5535bb76ac7020b5bae15456b4bd8d
SHA1

5c6fa2048e952a567b7ff7ead3774298ea80097d
SHA256

3b2ae0ebcc161123fe400511c2a715d23b6f37915aba534d865643959286a2f0
SHA512

62f11a8a5127605f09077d617752b24c35b748a9d5ee1ad71857a571db5a64402ca1cb53d62fd039c7179b1dcc31ac5e6d1bb5613b43fe360d231cec938d0dad
SSDEEP

6144:6gaslsyG2eU/w9MQ0aXVJg1twou1bY9J4TPYRVIh1Mholw/5YvICeFzWOwJP9adR:6NOU/rXlM94PYR5F5YMdhwJ8dW58vDn

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 1108	1244	3b2ae0ebcc161123fe400511c2a715d23b6f37915aba534d865643959286a2f0.exe	79
PID 1244 wrote to memory of 1108	1244	3b2ae0ebcc161123fe400511c2a715d23b6f37915aba534d865643959286a2f0.exe	79
PID 1244 wrote to memory of 1108	1244	3b2ae0ebcc161123fe400511c2a715d23b6f37915aba534d865643959286a2f0.exe	79
PID 1244 wrote to memory of 4772	1244	3b2ae0ebcc161123fe400511c2a715d23b6f37915aba534d865643959286a2f0.exe	80
PID 1244 wrote to memory of 4772	1244	3b2ae0ebcc161123fe400511c2a715d23b6f37915aba534d865643959286a2f0.exe	80
PID 1244 wrote to memory of 4772	1244	3b2ae0ebcc161123fe400511c2a715d23b6f37915aba534d865643959286a2f0.exe	80

C:\Users\Admin\AppData\Local\Temp\3b2ae0ebcc161123fe400511c2a715d23b6f37915aba534d865643959286a2f0.exe
"C:\Users\Admin\AppData\Local\Temp\3b2ae0ebcc161123fe400511c2a715d23b6f37915aba534d865643959286a2f0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Users\Admin\AppData\Local\Temp\3b2ae0ebcc161123fe400511c2a715d23b6f37915aba534d865643959286a2f0.exe
  start
  2⤵
  PID:1108
- C:\Users\Admin\AppData\Local\Temp\3b2ae0ebcc161123fe400511c2a715d23b6f37915aba534d865643959286a2f0.exe
  watch
  2⤵
  PID:4772

memory/1108-135-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/1108-137-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/1244-134-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/4772-136-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/4772-138-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download