becc8e9d65c08215693663d6e077f992b2a9b14c54409e43c90cfd9a72549e65

Analysis

max time kernel
198s
max time network
217s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 09:57

Target

becc8e9d65c08215693663d6e077f992b2a9b14c54409e43c90cfd9a72549e65.exe
Size

525KB
MD5

ee48926e10bc65acd7c9e06c0878637e
SHA1

1a6a2a908291474688048f87d34777d2a6cf433b
SHA256

becc8e9d65c08215693663d6e077f992b2a9b14c54409e43c90cfd9a72549e65
SHA512

9ce8e5905675ad9123faa09187374db9e35577b270ba5b367d8b5df71993bfafba8213a59db1451afbbdfc42195a0139da0e22e0f60c0e65b603b017a10c59f9
SSDEEP

6144:62Z9hs5MMYVQUTQDAt7FHXs+HmRS3HdWq54C1A6gaaePQuCJV5NhloBI0EUIP66W:62ZPWU1RF3gSXdWa445/A+6S0T

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 32	3212	becc8e9d65c08215693663d6e077f992b2a9b14c54409e43c90cfd9a72549e65.exe	81
PID 3212 wrote to memory of 32	3212	becc8e9d65c08215693663d6e077f992b2a9b14c54409e43c90cfd9a72549e65.exe	81
PID 3212 wrote to memory of 32	3212	becc8e9d65c08215693663d6e077f992b2a9b14c54409e43c90cfd9a72549e65.exe	81
PID 3212 wrote to memory of 208	3212	becc8e9d65c08215693663d6e077f992b2a9b14c54409e43c90cfd9a72549e65.exe	82
PID 3212 wrote to memory of 208	3212	becc8e9d65c08215693663d6e077f992b2a9b14c54409e43c90cfd9a72549e65.exe	82
PID 3212 wrote to memory of 208	3212	becc8e9d65c08215693663d6e077f992b2a9b14c54409e43c90cfd9a72549e65.exe	82

C:\Users\Admin\AppData\Local\Temp\becc8e9d65c08215693663d6e077f992b2a9b14c54409e43c90cfd9a72549e65.exe
"C:\Users\Admin\AppData\Local\Temp\becc8e9d65c08215693663d6e077f992b2a9b14c54409e43c90cfd9a72549e65.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Users\Admin\AppData\Local\Temp\becc8e9d65c08215693663d6e077f992b2a9b14c54409e43c90cfd9a72549e65.exe
  start
  2⤵
  PID:32
- C:\Users\Admin\AppData\Local\Temp\becc8e9d65c08215693663d6e077f992b2a9b14c54409e43c90cfd9a72549e65.exe
  watch
  2⤵
  PID:208

memory/32-136-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/32-137-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/32-140-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/32-141-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/208-135-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/208-138-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/208-139-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/208-142-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3212-134-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download