5aa09b97eaa26794f023e3df05b583733c4b36d18b8a9c47b160a16cae1f2d01

Analysis

max time kernel
216s
max time network
236s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 18:36

Target

5aa09b97eaa26794f023e3df05b583733c4b36d18b8a9c47b160a16cae1f2d01.exe
Size

22KB
MD5

3d052ccbfa4911e3c99be3fe5647dda3
SHA1

16a4de02ecaf5abe2374b44fef976d39f6ccfeaa
SHA256

5aa09b97eaa26794f023e3df05b583733c4b36d18b8a9c47b160a16cae1f2d01
SHA512

84c2ab76076c400e9f710ed717b8442bcf141f41f79d9488e7c61bc154c3637efbd471f3a0ab53213830ef5df25aa899fe176932ef73017c7d1f7c1e6a857b32
SSDEEP

192:g8AaHhlF8CEk3yqlcaG9eowRRJhf7ZQ1H1tLzjyFZrYcCDq:g8V8sCqlcaGPwfJNuN1ZzebrYrW

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 4508	2492	5aa09b97eaa26794f023e3df05b583733c4b36d18b8a9c47b160a16cae1f2d01.exe	84
PID 2492 wrote to memory of 4508	2492	5aa09b97eaa26794f023e3df05b583733c4b36d18b8a9c47b160a16cae1f2d01.exe	84
PID 2492 wrote to memory of 4508	2492	5aa09b97eaa26794f023e3df05b583733c4b36d18b8a9c47b160a16cae1f2d01.exe	84

C:\Users\Admin\AppData\Local\Temp\5aa09b97eaa26794f023e3df05b583733c4b36d18b8a9c47b160a16cae1f2d01.exe
"C:\Users\Admin\AppData\Local\Temp\5aa09b97eaa26794f023e3df05b583733c4b36d18b8a9c47b160a16cae1f2d01.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:4508