2ed68d75cfdff6b8bb0103af75c914d39082677be70d2f7e4c21c176d1b268fa

Analysis

max time kernel
140s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 04:53

Target

2ed68d75cfdff6b8bb0103af75c914d39082677be70d2f7e4c21c176d1b268fa.exe
Size

507KB
MD5

a39b74a26ead297bdf1ab6769d68a95a
SHA1

3d47ddac4b4f107625b2fd11e359844ed7e7d279
SHA256

2ed68d75cfdff6b8bb0103af75c914d39082677be70d2f7e4c21c176d1b268fa
SHA512

93c0fa8482fd22784737816f16c10bd0f837d73429cafb2f74c374d5d3c42a8b85cbee38d68b6687371b9ced473efb3d5a85a6dbd54eefd0ffc49cd67bf380b4
SSDEEP

6144:KUbdeiSfFBzHgtZWanHEPhPrj+jMXj4+DMjlqccMY63CorLYXalZxJCzIcN5fcFH:TbLPLpP+ncxYc9xIz4rwW

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2776	2092	2ed68d75cfdff6b8bb0103af75c914d39082677be70d2f7e4c21c176d1b268fa.exe	85
PID 2092 wrote to memory of 2776	2092	2ed68d75cfdff6b8bb0103af75c914d39082677be70d2f7e4c21c176d1b268fa.exe	85
PID 2092 wrote to memory of 2776	2092	2ed68d75cfdff6b8bb0103af75c914d39082677be70d2f7e4c21c176d1b268fa.exe	85
PID 2092 wrote to memory of 4668	2092	2ed68d75cfdff6b8bb0103af75c914d39082677be70d2f7e4c21c176d1b268fa.exe	86
PID 2092 wrote to memory of 4668	2092	2ed68d75cfdff6b8bb0103af75c914d39082677be70d2f7e4c21c176d1b268fa.exe	86
PID 2092 wrote to memory of 4668	2092	2ed68d75cfdff6b8bb0103af75c914d39082677be70d2f7e4c21c176d1b268fa.exe	86

C:\Users\Admin\AppData\Local\Temp\2ed68d75cfdff6b8bb0103af75c914d39082677be70d2f7e4c21c176d1b268fa.exe
"C:\Users\Admin\AppData\Local\Temp\2ed68d75cfdff6b8bb0103af75c914d39082677be70d2f7e4c21c176d1b268fa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Users\Admin\AppData\Local\Temp\2ed68d75cfdff6b8bb0103af75c914d39082677be70d2f7e4c21c176d1b268fa.exe
  start
  2⤵
  PID:2776
- C:\Users\Admin\AppData\Local\Temp\2ed68d75cfdff6b8bb0103af75c914d39082677be70d2f7e4c21c176d1b268fa.exe
  watch
  2⤵
  PID:4668

memory/2092-134-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/2092-135-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/2092-140-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/2776-136-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/2776-138-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/4668-137-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/4668-139-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download