dd2003392bc1a424132dfa767a4a6646316dcd937b5f58630c3fdd62145e8872

Analysis

max time kernel
206s
max time network
235s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 08:43

Target
dd2003392bc1a424132dfa767a4a6646316dcd937b5f58630c3fdd62145e8872.exe
Size 461KB
Sample221127-km26yagh4y
SHA256 dd2003392bc1a424132dfa767a4a6646316dcd937b5f58630c3fdd62145e8872
MD5 fcb704f3c9e82cf1f194540d373d243c
SHA1 42163f80ca9e56545b0ee6f500ff6d7e082c6782
SHA512 a335af561c980fa004169b3a64ee76c597134a7e915dc559b5d6dae6b5ec372dfdc3f8ab238986d88fb635a0154cc8696169a61d754eed2b5174dbc9efd18768
SSDEEP 6144:wdCXKjRNIi2S2wVw+jsPbkg+lcVUJBB/GRdgSX2k5B0rwZ7a0141bAI8SQyjee:lIFsbalsH2kVZG9P
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 204 wrote to memory of 4612	204	dd2003392bc1a424132dfa767a4a6646316dcd937b5f58630c3fdd62145e8872.exe	82
PID 204 wrote to memory of 4612	204	dd2003392bc1a424132dfa767a4a6646316dcd937b5f58630c3fdd62145e8872.exe	82
PID 204 wrote to memory of 4612	204	dd2003392bc1a424132dfa767a4a6646316dcd937b5f58630c3fdd62145e8872.exe	82
PID 204 wrote to memory of 2588	204	dd2003392bc1a424132dfa767a4a6646316dcd937b5f58630c3fdd62145e8872.exe	83
PID 204 wrote to memory of 2588	204	dd2003392bc1a424132dfa767a4a6646316dcd937b5f58630c3fdd62145e8872.exe	83
PID 204 wrote to memory of 2588	204	dd2003392bc1a424132dfa767a4a6646316dcd937b5f58630c3fdd62145e8872.exe	83

C:\Users\Admin\AppData\Local\Temp\dd2003392bc1a424132dfa767a4a6646316dcd937b5f58630c3fdd62145e8872.exe
"C:\Users\Admin\AppData\Local\Temp\dd2003392bc1a424132dfa767a4a6646316dcd937b5f58630c3fdd62145e8872.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:204
- C:\Users\Admin\AppData\Local\Temp\dd2003392bc1a424132dfa767a4a6646316dcd937b5f58630c3fdd62145e8872.exe
  start
  2⤵
  PID:4612
- C:\Users\Admin\AppData\Local\Temp\dd2003392bc1a424132dfa767a4a6646316dcd937b5f58630c3fdd62145e8872.exe
  watch
  2⤵
  PID:2588

memory/204-134-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2588-136-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2588-138-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2588-140-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4612-135-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4612-137-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4612-139-0x0000000000400000-0x0000000000477000-memory.dmp

Download