f28bcaf8ec8cbc60cbebf65361aedac8dc47134939863409827f16bb5d599456

Analysis

max time kernel
110s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 11:43

Target

f28bcaf8ec8cbc60cbebf65361aedac8dc47134939863409827f16bb5d599456.exe
Size

167KB
MD5

b22e21604b5befcee08b0927f79deec3
SHA1

4ee104f49579b7935bc18a7e0196581d53b7fc9a
SHA256

f28bcaf8ec8cbc60cbebf65361aedac8dc47134939863409827f16bb5d599456
SHA512

40fa2010eea5c6f924ce53ff1b946ecf07a04e967c0e2b540c27df4c1c44140bc0022e68bd1565f2401f2a80d04ae4f981e1b3866f14c26a77abcfcc3cc376b7
SSDEEP

3072:qYUFr7jFr0iJFeEQxEV4cVX08gqckleoyiiMLDGQ5/kgI:Ur0aFWECtfkNtGUI

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4992	f28bcaf8ec8cbc60cbebf65361aedac8dc47134939863409827f16bb5d599456.exe
4992	f28bcaf8ec8cbc60cbebf65361aedac8dc47134939863409827f16bb5d599456.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 3068	4992	f28bcaf8ec8cbc60cbebf65361aedac8dc47134939863409827f16bb5d599456.exe	70
PID 4992 wrote to memory of 3068	4992	f28bcaf8ec8cbc60cbebf65361aedac8dc47134939863409827f16bb5d599456.exe	70
PID 4992 wrote to memory of 3068	4992	f28bcaf8ec8cbc60cbebf65361aedac8dc47134939863409827f16bb5d599456.exe	70
PID 4992 wrote to memory of 3068	4992	f28bcaf8ec8cbc60cbebf65361aedac8dc47134939863409827f16bb5d599456.exe	70
PID 4992 wrote to memory of 3068	4992	f28bcaf8ec8cbc60cbebf65361aedac8dc47134939863409827f16bb5d599456.exe	70
PID 4992 wrote to memory of 3068	4992	f28bcaf8ec8cbc60cbebf65361aedac8dc47134939863409827f16bb5d599456.exe	70

memory/3068-132-0x000000007FFC0000-0x000000007FFC6000-memory.dmp

Filesize
24KB

Download
memory/4992-133-0x0000000000400000-0x00000000007A3000-memory.dmp

Filesize
3.6MB

Download
memory/4992-134-0x0000000002750000-0x0000000002840000-memory.dmp

Filesize
960KB

Download
memory/4992-135-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/4992-136-0x0000000000400000-0x00000000007A3000-memory.dmp

Filesize
3.6MB

Download