bb8ef69347ee311a29ca483d22ba283b7948ce7a31dfb967a1d2254fef935de6

Analysis

max time kernel
132s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 15:06

Target

bb8ef69347ee311a29ca483d22ba283b7948ce7a31dfb967a1d2254fef935de6.exe
Size

507KB
MD5

9a88df433aee04bbb49b29f97751fff5
SHA1

b2e5e5fd079b39f462c995460ee9fb335c80498a
SHA256

bb8ef69347ee311a29ca483d22ba283b7948ce7a31dfb967a1d2254fef935de6
SHA512

2475c0cdb4d5e412fa3b6ec822b3adf3ce8d595a4cb7d68405f768b7ebd69a7de3b175a827708cf6fac077b973aad4bcf1e86f1e4214379eb31853079991dc7c
SSDEEP

6144:3W6ZM2DxvPcat800BvX4gXWbmzBfOL/h2KKdiglfusxQCzIcN5fcFkJrFXW7e:GEnQBvibmzgDgKSXuEz4IXW

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 796 wrote to memory of 4868	796	bb8ef69347ee311a29ca483d22ba283b7948ce7a31dfb967a1d2254fef935de6.exe	81
PID 796 wrote to memory of 4868	796	bb8ef69347ee311a29ca483d22ba283b7948ce7a31dfb967a1d2254fef935de6.exe	81
PID 796 wrote to memory of 4868	796	bb8ef69347ee311a29ca483d22ba283b7948ce7a31dfb967a1d2254fef935de6.exe	81
PID 796 wrote to memory of 5072	796	bb8ef69347ee311a29ca483d22ba283b7948ce7a31dfb967a1d2254fef935de6.exe	82
PID 796 wrote to memory of 5072	796	bb8ef69347ee311a29ca483d22ba283b7948ce7a31dfb967a1d2254fef935de6.exe	82
PID 796 wrote to memory of 5072	796	bb8ef69347ee311a29ca483d22ba283b7948ce7a31dfb967a1d2254fef935de6.exe	82

C:\Users\Admin\AppData\Local\Temp\bb8ef69347ee311a29ca483d22ba283b7948ce7a31dfb967a1d2254fef935de6.exe
"C:\Users\Admin\AppData\Local\Temp\bb8ef69347ee311a29ca483d22ba283b7948ce7a31dfb967a1d2254fef935de6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:796
- C:\Users\Admin\AppData\Local\Temp\bb8ef69347ee311a29ca483d22ba283b7948ce7a31dfb967a1d2254fef935de6.exe
  start
  2⤵
  PID:4868
- C:\Users\Admin\AppData\Local\Temp\bb8ef69347ee311a29ca483d22ba283b7948ce7a31dfb967a1d2254fef935de6.exe
  watch
  2⤵
  PID:5072

memory/796-132-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/796-135-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/4868-136-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/4868-138-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/4868-140-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/5072-137-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/5072-139-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/5072-141-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download