b2bdefd264e53c358b544b26157a8df01bee96d00e09d679432cf87565cf03b8

Analysis

max time kernel
186s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 14:25

Target

b2bdefd264e53c358b544b26157a8df01bee96d00e09d679432cf87565cf03b8.exe
Size

55KB
MD5

8ff2737827c4fcb235185021fff32b63
SHA1

8903844ec413cb52e59f38aed2c8efba2abdc1e7
SHA256

b2bdefd264e53c358b544b26157a8df01bee96d00e09d679432cf87565cf03b8
SHA512

4a23d1de106ddb0544fbe6452a430f6eb51c640e3c46ebf5224a7a69ee3e3cef307c3c484f817f7b382142fc3e7aaec3558cb99ddd07dd977ee9dfff2fd7067e
SSDEEP

1536:dCKoLD+h/84UimkdxMeTi1DvCS/+xS6VF+0o8cT6:dCKomy45ZPmTl2AM+0o8cT6

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
112	b2bdefd264e53c358b544b26157a8df01bee96d00e09d679432cf87565cf03b8.exe
112	b2bdefd264e53c358b544b26157a8df01bee96d00e09d679432cf87565cf03b8.exe
112	b2bdefd264e53c358b544b26157a8df01bee96d00e09d679432cf87565cf03b8.exe
112	b2bdefd264e53c358b544b26157a8df01bee96d00e09d679432cf87565cf03b8.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 112 wrote to memory of 2632	112	b2bdefd264e53c358b544b26157a8df01bee96d00e09d679432cf87565cf03b8.exe	64
PID 112 wrote to memory of 2632	112	b2bdefd264e53c358b544b26157a8df01bee96d00e09d679432cf87565cf03b8.exe	64
PID 112 wrote to memory of 2632	112	b2bdefd264e53c358b544b26157a8df01bee96d00e09d679432cf87565cf03b8.exe	64
PID 112 wrote to memory of 2632	112	b2bdefd264e53c358b544b26157a8df01bee96d00e09d679432cf87565cf03b8.exe	64

memory/112-132-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/112-133-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/112-135-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2632-134-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download