a194b15d14524bb36859b979873e392c1577a24c850c271481854489865c621a

Analysis

max time kernel
185s
max time network
203s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 00:13

Target

a194b15d14524bb36859b979873e392c1577a24c850c271481854489865c621a.exe
Size

61KB
MD5

1bba48b591fb0fd96b42e5dde9c22b8b
SHA1

829ae86789fa37cfb2b76296b2c35f53144a1ec0
SHA256

a194b15d14524bb36859b979873e392c1577a24c850c271481854489865c621a
SHA512

da0e690dc421aa68694ba51b0e3276f4dec06589c32831ff1a2c6deaa461b2d41097e20316f35237fe2d4149f0a7ad94baa5fdfa397c60fc3b638f43b3891485
SSDEEP

1536:MQfCqh8WZ0PQU/uQM6S0b1e657SHMU8gt4yhOUvwrOSUN9PX:MGCcZ0IU/uQMP0oC7yMHgJhOUvwrhUN9

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 3324	4720	a194b15d14524bb36859b979873e392c1577a24c850c271481854489865c621a.exe	86
PID 4720 wrote to memory of 3324	4720	a194b15d14524bb36859b979873e392c1577a24c850c271481854489865c621a.exe	86
PID 4720 wrote to memory of 3324	4720	a194b15d14524bb36859b979873e392c1577a24c850c271481854489865c621a.exe	86

C:\Users\Admin\AppData\Local\Temp\a194b15d14524bb36859b979873e392c1577a24c850c271481854489865c621a.exe
"C:\Users\Admin\AppData\Local\Temp\a194b15d14524bb36859b979873e392c1577a24c850c271481854489865c621a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Users\Admin\AppData\Local\Temp\a194b15d14524bb36859b979873e392c1577a24c850c271481854489865c621a.exe
  C:\Users\Admin\AppData\Local\Temp\a194b15d14524bb36" 48
  2⤵
  PID:3324

memory/3324-133-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download