ec9902f3313dce88ef13ef13b16769e54edb781f9e74d51a7e3f464d0502da01

Analysis

max time kernel
91s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 15:41

Target

ec9902f3313dce88ef13ef13b16769e54edb781f9e74d51a7e3f464d0502da01.exe
Size

75KB
MD5

5c2cc29b0a00c3ed00f9c12b1cb4150a
SHA1

3128623cd6299451acccbd51f28e4d74bc91c89a
SHA256

ec9902f3313dce88ef13ef13b16769e54edb781f9e74d51a7e3f464d0502da01
SHA512

e9a14d3778745a03489e9df5b5caec9017fa460206b129cb76cec51035ec8008379e5ad20e1569503bf319c61a8a15b61d9dc5db5d7d3c3a7fa6175e46d9af02
SSDEEP

1536:mBj8d0+HjiifOBqvUlEhHJhdNEGm6DjIAJBV3L+lfDTw:mBj8d00iifO+hHJhDEGm6ooBkw

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 2692	3884	ec9902f3313dce88ef13ef13b16769e54edb781f9e74d51a7e3f464d0502da01.exe	82
PID 3884 wrote to memory of 2692	3884	ec9902f3313dce88ef13ef13b16769e54edb781f9e74d51a7e3f464d0502da01.exe	82
PID 3884 wrote to memory of 2692	3884	ec9902f3313dce88ef13ef13b16769e54edb781f9e74d51a7e3f464d0502da01.exe	82

C:\Users\Admin\AppData\Local\Temp\ec9902f3313dce88ef13ef13b16769e54edb781f9e74d51a7e3f464d0502da01.exe
"C:\Users\Admin\AppData\Local\Temp\ec9902f3313dce88ef13ef13b16769e54edb781f9e74d51a7e3f464d0502da01.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Users\Admin\AppData\Local\Temp\ec9902f3313dce88ef13ef13b16769e54edb781f9e74d51a7e3f464d0502da01.exe
  ?
  2⤵
  PID:2692

memory/2692-133-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download