85affdcbdb570cb99f98ccd727ab953ae5dd1c9e2a34533f9c77d760551f6b13

Analysis

max time kernel
152s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 10:05

Target

85affdcbdb570cb99f98ccd727ab953ae5dd1c9e2a34533f9c77d760551f6b13.exe
Size

525KB
MD5

0883f6b955a2b1b98b500c17c2e17b39
SHA1

bdb36fb8542b0cf9b36d1bdb5e800e696199c3f9
SHA256

85affdcbdb570cb99f98ccd727ab953ae5dd1c9e2a34533f9c77d760551f6b13
SHA512

ed17c40e375e7e9e92b8170aeed7dde68f49ae2193e7654224999682a82eb4ec38071334397389af8e54814dd30f0f4a0eaa0e3bc63174f3c487cc6c7cefc1e9
SSDEEP

6144:z2ZBOBMVd6mVy3VHIU8+3rV3J7ux5FItvZ6BVr5EbBI0EUIP6gaP8s5:z2ZBOes4yFHImptvABp5k600m

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 1540	4260	85affdcbdb570cb99f98ccd727ab953ae5dd1c9e2a34533f9c77d760551f6b13.exe	79
PID 4260 wrote to memory of 1540	4260	85affdcbdb570cb99f98ccd727ab953ae5dd1c9e2a34533f9c77d760551f6b13.exe	79
PID 4260 wrote to memory of 1540	4260	85affdcbdb570cb99f98ccd727ab953ae5dd1c9e2a34533f9c77d760551f6b13.exe	79
PID 4260 wrote to memory of 3976	4260	85affdcbdb570cb99f98ccd727ab953ae5dd1c9e2a34533f9c77d760551f6b13.exe	80
PID 4260 wrote to memory of 3976	4260	85affdcbdb570cb99f98ccd727ab953ae5dd1c9e2a34533f9c77d760551f6b13.exe	80
PID 4260 wrote to memory of 3976	4260	85affdcbdb570cb99f98ccd727ab953ae5dd1c9e2a34533f9c77d760551f6b13.exe	80

C:\Users\Admin\AppData\Local\Temp\85affdcbdb570cb99f98ccd727ab953ae5dd1c9e2a34533f9c77d760551f6b13.exe
"C:\Users\Admin\AppData\Local\Temp\85affdcbdb570cb99f98ccd727ab953ae5dd1c9e2a34533f9c77d760551f6b13.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Users\Admin\AppData\Local\Temp\85affdcbdb570cb99f98ccd727ab953ae5dd1c9e2a34533f9c77d760551f6b13.exe
  start
  2⤵
  PID:1540
- C:\Users\Admin\AppData\Local\Temp\85affdcbdb570cb99f98ccd727ab953ae5dd1c9e2a34533f9c77d760551f6b13.exe
  watch
  2⤵
  PID:3976

memory/1540-135-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1540-137-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3976-136-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3976-138-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/4260-134-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download