66f6b32fb69a78674108be4cc4122eb647c4e9388ec204ce5a7b27901c47df6f

Analysis

max time kernel
182s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 10:10

Target

66f6b32fb69a78674108be4cc4122eb647c4e9388ec204ce5a7b27901c47df6f.exe
Size

525KB
MD5

b6b53038ba2eef695eb403b37d4ea720
SHA1

b904ce92d3143b750ef912928dff21bcadb4056b
SHA256

66f6b32fb69a78674108be4cc4122eb647c4e9388ec204ce5a7b27901c47df6f
SHA512

1eb9877516c9e4836eac600b062de70dff74c24b28f7ddcf060c72c40ccd9730c3c060932225497f2cc51719e6a7dbc7372e49ab873fb9755fead9a1e63bfa4f
SSDEEP

6144:b2Zp9jXC8/DGI8iNX8moNMFT9ABi/amx9aCGOJLfDVyCFm+u0WDf08iri0CrBI0j:b2Z9imBx6ii6/LfTFmb0WXiry6S0kI

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3988 wrote to memory of 4496	3988	66f6b32fb69a78674108be4cc4122eb647c4e9388ec204ce5a7b27901c47df6f.exe	86
PID 3988 wrote to memory of 4496	3988	66f6b32fb69a78674108be4cc4122eb647c4e9388ec204ce5a7b27901c47df6f.exe	86
PID 3988 wrote to memory of 4496	3988	66f6b32fb69a78674108be4cc4122eb647c4e9388ec204ce5a7b27901c47df6f.exe	86
PID 3988 wrote to memory of 2180	3988	66f6b32fb69a78674108be4cc4122eb647c4e9388ec204ce5a7b27901c47df6f.exe	87
PID 3988 wrote to memory of 2180	3988	66f6b32fb69a78674108be4cc4122eb647c4e9388ec204ce5a7b27901c47df6f.exe	87
PID 3988 wrote to memory of 2180	3988	66f6b32fb69a78674108be4cc4122eb647c4e9388ec204ce5a7b27901c47df6f.exe	87

C:\Users\Admin\AppData\Local\Temp\66f6b32fb69a78674108be4cc4122eb647c4e9388ec204ce5a7b27901c47df6f.exe
"C:\Users\Admin\AppData\Local\Temp\66f6b32fb69a78674108be4cc4122eb647c4e9388ec204ce5a7b27901c47df6f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3988
- C:\Users\Admin\AppData\Local\Temp\66f6b32fb69a78674108be4cc4122eb647c4e9388ec204ce5a7b27901c47df6f.exe
  start
  2⤵
  PID:4496
- C:\Users\Admin\AppData\Local\Temp\66f6b32fb69a78674108be4cc4122eb647c4e9388ec204ce5a7b27901c47df6f.exe
  watch
  2⤵
  PID:2180

memory/2180-135-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2180-137-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2180-140-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2180-141-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3988-134-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/4496-136-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/4496-138-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/4496-139-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download