3a84b6cdbd6bdfd4e473fd0e30d5633c04cbbebe25356851110fb493d670cefd

Analysis

max time kernel
185s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 07:48

Target

3a84b6cdbd6bdfd4e473fd0e30d5633c04cbbebe25356851110fb493d670cefd.exe
Size

522KB
MD5

f438794f1e1953fe2154e7f874bb390e
SHA1

e3a889546956653d673b01e26b65164ed8994482
SHA256

3a84b6cdbd6bdfd4e473fd0e30d5633c04cbbebe25356851110fb493d670cefd
SHA512

820bc90798149beeae14298a5f2f5260f400dffac7f4b0f88e382cb7c81fb5d07906fc32ee87df91e033bd14910f6c57e451bbec38133789301c5ce57e705e80
SSDEEP

12288:8RT+B9KylpDDkeIY4VhVy18xQqpx8O5E:0Fy4jatqpx8

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

3a84b6cdbd6bdfd4e473fd0e30d5633c04cbbebe25356851110fb493d670cefd.exe

description	pid	process	target process
PID 4984 wrote to memory of 4876	4984	3a84b6cdbd6bdfd4e473fd0e30d5633c04cbbebe25356851110fb493d670cefd.exe	3a84b6cdbd6bdfd4e473fd0e30d5633c04cbbebe25356851110fb493d670cefd.exe
PID 4984 wrote to memory of 4876	4984	3a84b6cdbd6bdfd4e473fd0e30d5633c04cbbebe25356851110fb493d670cefd.exe	3a84b6cdbd6bdfd4e473fd0e30d5633c04cbbebe25356851110fb493d670cefd.exe
PID 4984 wrote to memory of 4876	4984	3a84b6cdbd6bdfd4e473fd0e30d5633c04cbbebe25356851110fb493d670cefd.exe	3a84b6cdbd6bdfd4e473fd0e30d5633c04cbbebe25356851110fb493d670cefd.exe
PID 4984 wrote to memory of 4868	4984	3a84b6cdbd6bdfd4e473fd0e30d5633c04cbbebe25356851110fb493d670cefd.exe	3a84b6cdbd6bdfd4e473fd0e30d5633c04cbbebe25356851110fb493d670cefd.exe
PID 4984 wrote to memory of 4868	4984	3a84b6cdbd6bdfd4e473fd0e30d5633c04cbbebe25356851110fb493d670cefd.exe	3a84b6cdbd6bdfd4e473fd0e30d5633c04cbbebe25356851110fb493d670cefd.exe
PID 4984 wrote to memory of 4868	4984	3a84b6cdbd6bdfd4e473fd0e30d5633c04cbbebe25356851110fb493d670cefd.exe	3a84b6cdbd6bdfd4e473fd0e30d5633c04cbbebe25356851110fb493d670cefd.exe

C:\Users\Admin\AppData\Local\Temp\3a84b6cdbd6bdfd4e473fd0e30d5633c04cbbebe25356851110fb493d670cefd.exe
"C:\Users\Admin\AppData\Local\Temp\3a84b6cdbd6bdfd4e473fd0e30d5633c04cbbebe25356851110fb493d670cefd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4984

C:\Users\Admin\AppData\Local\Temp\3a84b6cdbd6bdfd4e473fd0e30d5633c04cbbebe25356851110fb493d670cefd.exe
start
2⤵
PID:4876

C:\Users\Admin\AppData\Local\Temp\3a84b6cdbd6bdfd4e473fd0e30d5633c04cbbebe25356851110fb493d670cefd.exe
watch
2⤵
PID:4868

memory/4868-133-0x0000000000000000-mapping.dmp

Download
memory/4868-137-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4868-139-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4868-141-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4876-134-0x0000000000000000-mapping.dmp

Download
memory/4876-136-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4876-138-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4876-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4984-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4984-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download