a868938d181f2432bda9af21ee5f722c64488cd7f2e15ecef96c959e07eeac73

Analysis

max time kernel
124s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 23:44

Target

a868938d181f2432bda9af21ee5f722c64488cd7f2e15ecef96c959e07eeac73.exe
Size

68KB
MD5

276fcacd843e4180fbc9ec8f7183ad00
SHA1

d6c1470e25de6a6afef539a301cb263ee27c2436
SHA256

a868938d181f2432bda9af21ee5f722c64488cd7f2e15ecef96c959e07eeac73
SHA512

35646a8a750796aa85154f3faa7a7710fcc9ece7e8133931d083454f791b81fd7a63a82d48071aa74641a021173a5a3a0d90baf2ab34876aad33aa4f91c0becd
SSDEEP

1536:8EexvPE2XOBblLH5XnzvArr3oISkYZRIVcPhfvVTskg:ZaXkRHhbArroIYrZ5W

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 5048	4032	a868938d181f2432bda9af21ee5f722c64488cd7f2e15ecef96c959e07eeac73.exe	82
PID 4032 wrote to memory of 5048	4032	a868938d181f2432bda9af21ee5f722c64488cd7f2e15ecef96c959e07eeac73.exe	82
PID 4032 wrote to memory of 5048	4032	a868938d181f2432bda9af21ee5f722c64488cd7f2e15ecef96c959e07eeac73.exe	82

C:\Users\Admin\AppData\Local\Temp\a868938d181f2432bda9af21ee5f722c64488cd7f2e15ecef96c959e07eeac73.exe
"C:\Users\Admin\AppData\Local\Temp\a868938d181f2432bda9af21ee5f722c64488cd7f2e15ecef96c959e07eeac73.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Users\Admin\AppData\Local\Temp\a868938d181f2432bda9af21ee5f722c64488cd7f2e15ecef96c959e07eeac73.exe
  C:\Users\Admin\AppData\Local\Temp\a868938d181f2432b" 48
  2⤵
  PID:5048

memory/5048-132-0x0000000000000000-mapping.dmp

Download
memory/5048-133-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download