a4f65d765b0cf55277d305a10f8f14fff3858dce6c133959f63d48fad64f0e39

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 21:16

Target

a4f65d765b0cf55277d305a10f8f14fff3858dce6c133959f63d48fad64f0e39.exe
Size

482KB
MD5

a04b2df1b5860df60c09e7e7c6a4bce3
SHA1

72ae217a1e61a01feeff0599453930f9ca8bccfd
SHA256

a4f65d765b0cf55277d305a10f8f14fff3858dce6c133959f63d48fad64f0e39
SHA512

9ed5dd83ea2bae9cf4881b4028a7add39ad3f60e619c98cdcb0b1972e71bdd3408ea285b7d11421b4001d69eb12e578ab7f46f1deeda8aba7c84a117f82cd280
SSDEEP

12288:fkIkv1yGgNCBQ2R4UwJNry6dYGOnEFcte:1kv1yVAB1Vwjr7QU

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

a4f65d765b0cf55277d305a10f8f14fff3858dce6c133959f63d48fad64f0e39.exe

description	pid	process	target process
PID 3360 wrote to memory of 644	3360	a4f65d765b0cf55277d305a10f8f14fff3858dce6c133959f63d48fad64f0e39.exe	a4f65d765b0cf55277d305a10f8f14fff3858dce6c133959f63d48fad64f0e39.exe
PID 3360 wrote to memory of 644	3360	a4f65d765b0cf55277d305a10f8f14fff3858dce6c133959f63d48fad64f0e39.exe	a4f65d765b0cf55277d305a10f8f14fff3858dce6c133959f63d48fad64f0e39.exe
PID 3360 wrote to memory of 644	3360	a4f65d765b0cf55277d305a10f8f14fff3858dce6c133959f63d48fad64f0e39.exe	a4f65d765b0cf55277d305a10f8f14fff3858dce6c133959f63d48fad64f0e39.exe
PID 3360 wrote to memory of 3544	3360	a4f65d765b0cf55277d305a10f8f14fff3858dce6c133959f63d48fad64f0e39.exe	a4f65d765b0cf55277d305a10f8f14fff3858dce6c133959f63d48fad64f0e39.exe
PID 3360 wrote to memory of 3544	3360	a4f65d765b0cf55277d305a10f8f14fff3858dce6c133959f63d48fad64f0e39.exe	a4f65d765b0cf55277d305a10f8f14fff3858dce6c133959f63d48fad64f0e39.exe
PID 3360 wrote to memory of 3544	3360	a4f65d765b0cf55277d305a10f8f14fff3858dce6c133959f63d48fad64f0e39.exe	a4f65d765b0cf55277d305a10f8f14fff3858dce6c133959f63d48fad64f0e39.exe

C:\Users\Admin\AppData\Local\Temp\a4f65d765b0cf55277d305a10f8f14fff3858dce6c133959f63d48fad64f0e39.exe
"C:\Users\Admin\AppData\Local\Temp\a4f65d765b0cf55277d305a10f8f14fff3858dce6c133959f63d48fad64f0e39.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3360

C:\Users\Admin\AppData\Local\Temp\a4f65d765b0cf55277d305a10f8f14fff3858dce6c133959f63d48fad64f0e39.exe
start
2⤵
PID:644

C:\Users\Admin\AppData\Local\Temp\a4f65d765b0cf55277d305a10f8f14fff3858dce6c133959f63d48fad64f0e39.exe
watch
2⤵
PID:3544

memory/644-133-0x0000000000000000-mapping.dmp

Download
memory/644-136-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/644-138-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/3360-132-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/3360-135-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/3544-134-0x0000000000000000-mapping.dmp

Download
memory/3544-137-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/3544-139-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download