fcfb492d3ee5aed782e92f92a9e72fd72f07858f064ad1c0f68678bd2e94f99e

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 09:47

Target

fcfb492d3ee5aed782e92f92a9e72fd72f07858f064ad1c0f68678bd2e94f99e.exe
Size

529KB
MD5

7c91c0ddbf84bd6996621983a48dfaab
SHA1

e9e0c447afcae09a2bb9a31ac4ecccab0717256e
SHA256

fcfb492d3ee5aed782e92f92a9e72fd72f07858f064ad1c0f68678bd2e94f99e
SHA512

77baf7a3b9a08e552cc97712057e82b528ddea30060f0c6c291c68f212e394db944ac3819ed9464e1003a121cf9f35aa2273ed93f89e074ff33be8004958c409
SSDEEP

6144:Y2ZCwqKivuVeeLmJY6qIQqZTpDYeg1apy3291eXaN7ggH+ukTgZZno3aPQicBI0F:Y2Z9qK/6hTQZ0py3291sa6vT9Z6q0mp

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 4724	2808	fcfb492d3ee5aed782e92f92a9e72fd72f07858f064ad1c0f68678bd2e94f99e.exe	82
PID 2808 wrote to memory of 4724	2808	fcfb492d3ee5aed782e92f92a9e72fd72f07858f064ad1c0f68678bd2e94f99e.exe	82
PID 2808 wrote to memory of 4724	2808	fcfb492d3ee5aed782e92f92a9e72fd72f07858f064ad1c0f68678bd2e94f99e.exe	82
PID 2808 wrote to memory of 2160	2808	fcfb492d3ee5aed782e92f92a9e72fd72f07858f064ad1c0f68678bd2e94f99e.exe	83
PID 2808 wrote to memory of 2160	2808	fcfb492d3ee5aed782e92f92a9e72fd72f07858f064ad1c0f68678bd2e94f99e.exe	83
PID 2808 wrote to memory of 2160	2808	fcfb492d3ee5aed782e92f92a9e72fd72f07858f064ad1c0f68678bd2e94f99e.exe	83

C:\Users\Admin\AppData\Local\Temp\fcfb492d3ee5aed782e92f92a9e72fd72f07858f064ad1c0f68678bd2e94f99e.exe
"C:\Users\Admin\AppData\Local\Temp\fcfb492d3ee5aed782e92f92a9e72fd72f07858f064ad1c0f68678bd2e94f99e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Users\Admin\AppData\Local\Temp\fcfb492d3ee5aed782e92f92a9e72fd72f07858f064ad1c0f68678bd2e94f99e.exe
  start
  2⤵
  PID:4724
- C:\Users\Admin\AppData\Local\Temp\fcfb492d3ee5aed782e92f92a9e72fd72f07858f064ad1c0f68678bd2e94f99e.exe
  watch
  2⤵
  PID:2160

memory/2160-136-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2160-137-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2160-140-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2808-134-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/4724-135-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/4724-138-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/4724-139-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download