4cfdec01689c9266f807b42411037845afc4975b93c483c7d90d4ebe1d88ea3e

Analysis

max time kernel
137s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 06:19

Target

4cfdec01689c9266f807b42411037845afc4975b93c483c7d90d4ebe1d88ea3e.exe
Size

507KB
MD5

97bcb9915e48143dbf729aba2f86c0aa
SHA1

e7fa86b4e3dbc5e5bd9b30d3fa39669d8d2491c1
SHA256

4cfdec01689c9266f807b42411037845afc4975b93c483c7d90d4ebe1d88ea3e
SHA512

76a042ec68594d739920f8514926fc8a85c3ca64bbb65eec240170a73f958d41e2037e71da52ba6a829adda6d7c5834f3d04cb9669937110406f6d8733419956
SSDEEP

6144:gQ/5Nj3zODrW6ef54U2xxgwGfN8abovlxhvdL9OIt+c8QbIGA9GCzIcN5fcFkJry:LTDYW/qxiQ91pbBA9Tz4BtFelW

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 3024	1280	4cfdec01689c9266f807b42411037845afc4975b93c483c7d90d4ebe1d88ea3e.exe	81
PID 1280 wrote to memory of 3024	1280	4cfdec01689c9266f807b42411037845afc4975b93c483c7d90d4ebe1d88ea3e.exe	81
PID 1280 wrote to memory of 3024	1280	4cfdec01689c9266f807b42411037845afc4975b93c483c7d90d4ebe1d88ea3e.exe	81
PID 1280 wrote to memory of 1680	1280	4cfdec01689c9266f807b42411037845afc4975b93c483c7d90d4ebe1d88ea3e.exe	82
PID 1280 wrote to memory of 1680	1280	4cfdec01689c9266f807b42411037845afc4975b93c483c7d90d4ebe1d88ea3e.exe	82
PID 1280 wrote to memory of 1680	1280	4cfdec01689c9266f807b42411037845afc4975b93c483c7d90d4ebe1d88ea3e.exe	82

C:\Users\Admin\AppData\Local\Temp\4cfdec01689c9266f807b42411037845afc4975b93c483c7d90d4ebe1d88ea3e.exe
"C:\Users\Admin\AppData\Local\Temp\4cfdec01689c9266f807b42411037845afc4975b93c483c7d90d4ebe1d88ea3e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Users\Admin\AppData\Local\Temp\4cfdec01689c9266f807b42411037845afc4975b93c483c7d90d4ebe1d88ea3e.exe
  start
  2⤵
  PID:3024
- C:\Users\Admin\AppData\Local\Temp\4cfdec01689c9266f807b42411037845afc4975b93c483c7d90d4ebe1d88ea3e.exe
  watch
  2⤵
  PID:1680

memory/1280-134-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1280-135-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1680-137-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1680-139-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/3024-136-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/3024-138-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download