bc1db07da72c134120602b5997da52161ed681d53386f827f6498dbbfcd3f06a

Analysis

max time kernel
154s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 23:59

Target

bc1db07da72c134120602b5997da52161ed681d53386f827f6498dbbfcd3f06a.exe
Size

481KB
MD5

e5b20ab70b5becda1de59b4b6d263862
SHA1

eb19bf98561630dfdc0171ae98e441e2f6acba26
SHA256

bc1db07da72c134120602b5997da52161ed681d53386f827f6498dbbfcd3f06a
SHA512

c554e51d3ac57554e3f45d6e1ce426acad502e692d6f339fbb6e1562719db435fadfad51ee4c2d2637e4cc2f8bc9c87231076c558c73c2c3d5e9b40b8679bd6b
SSDEEP

6144:rl8iXj0grPCIsnDm0cYL5evHqqa+P50TJGpfYsfJxWhCM9xG96A7qQ2jM9AW:ru9PDaYL5e/7adT5h/fhLQ2sA

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 380	3952	bc1db07da72c134120602b5997da52161ed681d53386f827f6498dbbfcd3f06a.exe	82
PID 3952 wrote to memory of 380	3952	bc1db07da72c134120602b5997da52161ed681d53386f827f6498dbbfcd3f06a.exe	82
PID 3952 wrote to memory of 380	3952	bc1db07da72c134120602b5997da52161ed681d53386f827f6498dbbfcd3f06a.exe	82
PID 3952 wrote to memory of 404	3952	bc1db07da72c134120602b5997da52161ed681d53386f827f6498dbbfcd3f06a.exe	83
PID 3952 wrote to memory of 404	3952	bc1db07da72c134120602b5997da52161ed681d53386f827f6498dbbfcd3f06a.exe	83
PID 3952 wrote to memory of 404	3952	bc1db07da72c134120602b5997da52161ed681d53386f827f6498dbbfcd3f06a.exe	83

C:\Users\Admin\AppData\Local\Temp\bc1db07da72c134120602b5997da52161ed681d53386f827f6498dbbfcd3f06a.exe
"C:\Users\Admin\AppData\Local\Temp\bc1db07da72c134120602b5997da52161ed681d53386f827f6498dbbfcd3f06a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Users\Admin\AppData\Local\Temp\bc1db07da72c134120602b5997da52161ed681d53386f827f6498dbbfcd3f06a.exe
  start
  2⤵
  PID:380
- C:\Users\Admin\AppData\Local\Temp\bc1db07da72c134120602b5997da52161ed681d53386f827f6498dbbfcd3f06a.exe
  watch
  2⤵
  PID:404

memory/380-135-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/380-137-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/380-139-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/404-136-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/404-138-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/404-140-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/3952-134-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download