cd6db4adb30ba5dc0d1d7cf28342a62fa9e2a9e14b9a91650d3e87662762c93f

Analysis

max time kernel
191s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 14:57

Target

cd6db4adb30ba5dc0d1d7cf28342a62fa9e2a9e14b9a91650d3e87662762c93f.exe
Size

511KB
MD5

9b65e8631d708872287ef9bce3309a47
SHA1

afd61b97a2c35718116d75e8ba2323e44876592a
SHA256

cd6db4adb30ba5dc0d1d7cf28342a62fa9e2a9e14b9a91650d3e87662762c93f
SHA512

aa3ff0868ffc3b7f90ab979f10b499e8af1b796bbf6e5d1d9e5be8e3c2c50eeef9ec3ab38d6d34b8539a79ba6263b4bcfd892a4900c3748ecc5e9d99f52c55be
SSDEEP

6144:fSqE53UXB1m+2u7z/8fDtHEsMYuSaTXy+Fo2+jG/QNJ3Nk54915ogCzIcN5fcFkd:tTx+4rg9cTPTCC/m9VKxz42VzW6r

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 1348	3872	cd6db4adb30ba5dc0d1d7cf28342a62fa9e2a9e14b9a91650d3e87662762c93f.exe	82
PID 3872 wrote to memory of 1348	3872	cd6db4adb30ba5dc0d1d7cf28342a62fa9e2a9e14b9a91650d3e87662762c93f.exe	82
PID 3872 wrote to memory of 1348	3872	cd6db4adb30ba5dc0d1d7cf28342a62fa9e2a9e14b9a91650d3e87662762c93f.exe	82
PID 3872 wrote to memory of 4856	3872	cd6db4adb30ba5dc0d1d7cf28342a62fa9e2a9e14b9a91650d3e87662762c93f.exe	83
PID 3872 wrote to memory of 4856	3872	cd6db4adb30ba5dc0d1d7cf28342a62fa9e2a9e14b9a91650d3e87662762c93f.exe	83
PID 3872 wrote to memory of 4856	3872	cd6db4adb30ba5dc0d1d7cf28342a62fa9e2a9e14b9a91650d3e87662762c93f.exe	83

C:\Users\Admin\AppData\Local\Temp\cd6db4adb30ba5dc0d1d7cf28342a62fa9e2a9e14b9a91650d3e87662762c93f.exe
"C:\Users\Admin\AppData\Local\Temp\cd6db4adb30ba5dc0d1d7cf28342a62fa9e2a9e14b9a91650d3e87662762c93f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Users\Admin\AppData\Local\Temp\cd6db4adb30ba5dc0d1d7cf28342a62fa9e2a9e14b9a91650d3e87662762c93f.exe
  start
  2⤵
  PID:1348
- C:\Users\Admin\AppData\Local\Temp\cd6db4adb30ba5dc0d1d7cf28342a62fa9e2a9e14b9a91650d3e87662762c93f.exe
  watch
  2⤵
  PID:4856

memory/1348-141-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1348-134-0x0000000000000000-mapping.dmp

Download
memory/1348-137-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1348-143-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1348-139-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/3872-133-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/3872-132-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/3872-136-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/4856-135-0x0000000000000000-mapping.dmp

Download
memory/4856-140-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/4856-142-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/4856-138-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/4856-144-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download