0690d219232dbdb4867cd4e9a14d5fa1bbee7170b541d5a5ec52540b4e020edb

Analysis

max time kernel
152s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 06:18

Target

0690d219232dbdb4867cd4e9a14d5fa1bbee7170b541d5a5ec52540b4e020edb.exe
Size

61KB
MD5

9a248abb319644ffa932cce235ccb26d
SHA1

55577eae23d1390c6215b6eda77fbc2a7fbc4ae0
SHA256

0690d219232dbdb4867cd4e9a14d5fa1bbee7170b541d5a5ec52540b4e020edb
SHA512

fdd2128849f3d1a64ff532a0c627546c5d8439ca8c7f7eb5e2ade5e7206992a48343bf3ea7a37922f301c0075a9e0429a6ab984e976fc6d9d18bd807db921680
SSDEEP

1536:MMEdxC6n8r4qWnnHNe915hhOgughzB8lXeNvVTskg:exCEq1gfwB8lODW

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 4348	1208	0690d219232dbdb4867cd4e9a14d5fa1bbee7170b541d5a5ec52540b4e020edb.exe	84
PID 1208 wrote to memory of 4348	1208	0690d219232dbdb4867cd4e9a14d5fa1bbee7170b541d5a5ec52540b4e020edb.exe	84
PID 1208 wrote to memory of 4348	1208	0690d219232dbdb4867cd4e9a14d5fa1bbee7170b541d5a5ec52540b4e020edb.exe	84

C:\Users\Admin\AppData\Local\Temp\0690d219232dbdb4867cd4e9a14d5fa1bbee7170b541d5a5ec52540b4e020edb.exe
"C:\Users\Admin\AppData\Local\Temp\0690d219232dbdb4867cd4e9a14d5fa1bbee7170b541d5a5ec52540b4e020edb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Users\Admin\AppData\Local\Temp\0690d219232dbdb4867cd4e9a14d5fa1bbee7170b541d5a5ec52540b4e020edb.exe
  C:\Users\Admin\AppData\Local\Temp\0690d219232dbdb48" 48
  2⤵
  PID:4348

memory/4348-133-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download