9936eabd67c75274a8e4226267a88052990d368d06bd390f3e33ff5c8845c291

Analysis

max time kernel
151s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 15:26

Target

9936eabd67c75274a8e4226267a88052990d368d06bd390f3e33ff5c8845c291.exe
Size

507KB
MD5

334626a6b7067db1b15c57234569849d
SHA1

dc5edd15a4bdcfc9be680ddd49ee248600a2e069
SHA256

9936eabd67c75274a8e4226267a88052990d368d06bd390f3e33ff5c8845c291
SHA512

1f33f80582745fb1fe13529416b3d579af600fbc9adf75240b1242cd58673783c84f986665f3ae4fc3837f8bd93f21c8a91a22b69e66939f2101ec1bae7727d5
SSDEEP

6144:u3eVFliY5IC5NiKN4HZpqstfBvDnPvudT5m3DU95RVqeKU23ovnYCzIcN5fcFkJB:6mliY5d5lN45BpxXuK3wN2Wz4/6W

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 1820	3140	9936eabd67c75274a8e4226267a88052990d368d06bd390f3e33ff5c8845c291.exe	86
PID 3140 wrote to memory of 1820	3140	9936eabd67c75274a8e4226267a88052990d368d06bd390f3e33ff5c8845c291.exe	86
PID 3140 wrote to memory of 1820	3140	9936eabd67c75274a8e4226267a88052990d368d06bd390f3e33ff5c8845c291.exe	86
PID 3140 wrote to memory of 5068	3140	9936eabd67c75274a8e4226267a88052990d368d06bd390f3e33ff5c8845c291.exe	87
PID 3140 wrote to memory of 5068	3140	9936eabd67c75274a8e4226267a88052990d368d06bd390f3e33ff5c8845c291.exe	87
PID 3140 wrote to memory of 5068	3140	9936eabd67c75274a8e4226267a88052990d368d06bd390f3e33ff5c8845c291.exe	87

C:\Users\Admin\AppData\Local\Temp\9936eabd67c75274a8e4226267a88052990d368d06bd390f3e33ff5c8845c291.exe
"C:\Users\Admin\AppData\Local\Temp\9936eabd67c75274a8e4226267a88052990d368d06bd390f3e33ff5c8845c291.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Users\Admin\AppData\Local\Temp\9936eabd67c75274a8e4226267a88052990d368d06bd390f3e33ff5c8845c291.exe
  start
  2⤵
  PID:1820
- C:\Users\Admin\AppData\Local\Temp\9936eabd67c75274a8e4226267a88052990d368d06bd390f3e33ff5c8845c291.exe
  watch
  2⤵
  PID:5068

memory/1820-136-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1820-139-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1820-140-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/3140-132-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/3140-135-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/5068-137-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/5068-138-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/5068-141-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/5068-142-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download