4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168

Analysis

max time kernel
122s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 01:54

Target

4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168.exe
Size

488KB
MD5

e894630e1936e2e7775740c13fa2b38a
SHA1

2586adda22521e01b0dfb66468e54fb951fffdc0
SHA256

4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168
SHA512

1552c864e3f02837270fbca634e489e084a59ff25a9ee1292a55b17b1226837764ae480bbee638b77f3695406e7de04556cd5b9d453a950c883111375694bab8
SSDEEP

6144:2XwfGPzw9AN58A4z8GYOinammngNp1V98U3/E3FA/zY9UdrIdn+iudYAMpxka0Oy:2gfGEHz8xRazgNgUvE3uECleAMpxkRE8

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168.exe

description	pid	process	target process
PID 1688 wrote to memory of 3780	1688	4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168.exe	4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168.exe
PID 1688 wrote to memory of 3780	1688	4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168.exe	4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168.exe
PID 1688 wrote to memory of 3780	1688	4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168.exe	4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168.exe
PID 1688 wrote to memory of 4320	1688	4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168.exe	4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168.exe
PID 1688 wrote to memory of 4320	1688	4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168.exe	4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168.exe
PID 1688 wrote to memory of 4320	1688	4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168.exe	4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168.exe

C:\Users\Admin\AppData\Local\Temp\4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168.exe
"C:\Users\Admin\AppData\Local\Temp\4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1688

C:\Users\Admin\AppData\Local\Temp\4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168.exe
start
2⤵
PID:3780

C:\Users\Admin\AppData\Local\Temp\4ab020dd072913a4734c731c535bfc43df8e00fb61cfaf2cb259237c3d777168.exe
watch
2⤵
PID:4320

memory/1688-133-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1688-136-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1688-132-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3780-142-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3780-143-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3780-134-0x0000000000000000-mapping.dmp

Download
memory/3780-137-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3780-139-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4320-138-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4320-141-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4320-140-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4320-135-0x0000000000000000-mapping.dmp

Download
memory/4320-144-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download