5fa963937c72ed41d2f0657a9c8bbd9a6d27a6471a1e51b1d5b54d686ca50de7

Analysis

max time kernel
151s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 08:41

Target

5fa963937c72ed41d2f0657a9c8bbd9a6d27a6471a1e51b1d5b54d686ca50de7.exe
Size

111KB
MD5

68c052193d908972d2d9cad2a8239646
SHA1

d0dbfad4eac7161f3a81bf0069c3883983ec3038
SHA256

5fa963937c72ed41d2f0657a9c8bbd9a6d27a6471a1e51b1d5b54d686ca50de7
SHA512

b64d6599af0c3fdb7e8b58a73e795b3b57e89aa7fa72372fda2f0eb242ed5eca7220559eedf76f068f3b570a24404941c1b8a1393e58271b690742bb2bf853c6
SSDEEP

1536:i8/KJUa7BdbOrAlUNbpZ3B5vUbFMGJ9swGdLp7UlySHf0vVTskg:i8CKrzNbT3E55T0p7UlyS/KW

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3868	5fa963937c72ed41d2f0657a9c8bbd9a6d27a6471a1e51b1d5b54d686ca50de7.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 3868	2200	5fa963937c72ed41d2f0657a9c8bbd9a6d27a6471a1e51b1d5b54d686ca50de7.exe	80
PID 2200 wrote to memory of 3868	2200	5fa963937c72ed41d2f0657a9c8bbd9a6d27a6471a1e51b1d5b54d686ca50de7.exe	80
PID 2200 wrote to memory of 3868	2200	5fa963937c72ed41d2f0657a9c8bbd9a6d27a6471a1e51b1d5b54d686ca50de7.exe	80

C:\Users\Admin\AppData\Local\Temp\5fa963937c72ed41d2f0657a9c8bbd9a6d27a6471a1e51b1d5b54d686ca50de7.exe
"C:\Users\Admin\AppData\Local\Temp\5fa963937c72ed41d2f0657a9c8bbd9a6d27a6471a1e51b1d5b54d686ca50de7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Users\Admin\AppData\Local\Temp\5fa963937c72ed41d2f0657a9c8bbd9a6d27a6471a1e51b1d5b54d686ca50de7.exe
  C:\Users\Admin\AppData\Local\Temp\5fa963937c72ed41d" 48
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3868

memory/3868-133-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download