68bd68dda267f4b88ece85e004ae331c184078fafa8f37264518aada5858c4f9

Analysis

max time kernel
232s
max time network
254s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 23:57

Target

68bd68dda267f4b88ece85e004ae331c184078fafa8f37264518aada5858c4f9.exe
Size

519KB
MD5

24b2ae6635ad58ff9257485988fcbfe5
SHA1

736509e369a0c40e8c2826f2539e060023e08828
SHA256

68bd68dda267f4b88ece85e004ae331c184078fafa8f37264518aada5858c4f9
SHA512

00b3d5bc3daf9590bd5a4d508dcfa45aa39d8e2d22f6e5f7cf2659ded129367a94f759a86ed8bec33ab85305196854e2bbf02b419803d965446293eedabd2396
SSDEEP

6144:k84fd6ZPePXVwlSY9zkrQuvj7dDnAITysP2OWtGoooPnyJP5KmVaY6CQS6EVS/MH:kcZEwEYdbmDvRCO54YXpSVX

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 2488	3076	68bd68dda267f4b88ece85e004ae331c184078fafa8f37264518aada5858c4f9.exe	82
PID 3076 wrote to memory of 2488	3076	68bd68dda267f4b88ece85e004ae331c184078fafa8f37264518aada5858c4f9.exe	82
PID 3076 wrote to memory of 2488	3076	68bd68dda267f4b88ece85e004ae331c184078fafa8f37264518aada5858c4f9.exe	82
PID 3076 wrote to memory of 2508	3076	68bd68dda267f4b88ece85e004ae331c184078fafa8f37264518aada5858c4f9.exe	83
PID 3076 wrote to memory of 2508	3076	68bd68dda267f4b88ece85e004ae331c184078fafa8f37264518aada5858c4f9.exe	83
PID 3076 wrote to memory of 2508	3076	68bd68dda267f4b88ece85e004ae331c184078fafa8f37264518aada5858c4f9.exe	83

C:\Users\Admin\AppData\Local\Temp\68bd68dda267f4b88ece85e004ae331c184078fafa8f37264518aada5858c4f9.exe
"C:\Users\Admin\AppData\Local\Temp\68bd68dda267f4b88ece85e004ae331c184078fafa8f37264518aada5858c4f9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Users\Admin\AppData\Local\Temp\68bd68dda267f4b88ece85e004ae331c184078fafa8f37264518aada5858c4f9.exe
  start
  2⤵
  PID:2488
- C:\Users\Admin\AppData\Local\Temp\68bd68dda267f4b88ece85e004ae331c184078fafa8f37264518aada5858c4f9.exe
  watch
  2⤵
  PID:2508

memory/2488-137-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/2488-139-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/2488-140-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/2508-136-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/2508-138-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/2508-141-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/3076-132-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/3076-135-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download