aea3f087d8e73350789f82304db214d6bdd5a0785afe97ae1acf0be4cc8b9169

Analysis

max time kernel
205s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 17:31

Target

aea3f087d8e73350789f82304db214d6bdd5a0785afe97ae1acf0be4cc8b9169.exe
Size

546KB
MD5

0c4c251897cbe099a139db9ee3a33578
SHA1

6b86920bf912c1870f2113d54127b6085cb57e6f
SHA256

aea3f087d8e73350789f82304db214d6bdd5a0785afe97ae1acf0be4cc8b9169
SHA512

38a5347732ae4c1ad1665a136354610708bf0d6240af39c5df15812177dbee99719a3443294041ffba190ba6afe2d6f2197246c9a322947956b671e4b4816bac
SSDEEP

12288:gH0w8eQb9BXxj+79K9nVLV2HsSO+GGXFN:gyeC9lg79K9Vx2HsSO+Gsf

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

aea3f087d8e73350789f82304db214d6bdd5a0785afe97ae1acf0be4cc8b9169.exe

description	pid	process	target process
PID 3388 wrote to memory of 3644	3388	aea3f087d8e73350789f82304db214d6bdd5a0785afe97ae1acf0be4cc8b9169.exe	aea3f087d8e73350789f82304db214d6bdd5a0785afe97ae1acf0be4cc8b9169.exe
PID 3388 wrote to memory of 3644	3388	aea3f087d8e73350789f82304db214d6bdd5a0785afe97ae1acf0be4cc8b9169.exe	aea3f087d8e73350789f82304db214d6bdd5a0785afe97ae1acf0be4cc8b9169.exe
PID 3388 wrote to memory of 3644	3388	aea3f087d8e73350789f82304db214d6bdd5a0785afe97ae1acf0be4cc8b9169.exe	aea3f087d8e73350789f82304db214d6bdd5a0785afe97ae1acf0be4cc8b9169.exe
PID 3388 wrote to memory of 3480	3388	aea3f087d8e73350789f82304db214d6bdd5a0785afe97ae1acf0be4cc8b9169.exe	aea3f087d8e73350789f82304db214d6bdd5a0785afe97ae1acf0be4cc8b9169.exe
PID 3388 wrote to memory of 3480	3388	aea3f087d8e73350789f82304db214d6bdd5a0785afe97ae1acf0be4cc8b9169.exe	aea3f087d8e73350789f82304db214d6bdd5a0785afe97ae1acf0be4cc8b9169.exe
PID 3388 wrote to memory of 3480	3388	aea3f087d8e73350789f82304db214d6bdd5a0785afe97ae1acf0be4cc8b9169.exe	aea3f087d8e73350789f82304db214d6bdd5a0785afe97ae1acf0be4cc8b9169.exe

C:\Users\Admin\AppData\Local\Temp\aea3f087d8e73350789f82304db214d6bdd5a0785afe97ae1acf0be4cc8b9169.exe
"C:\Users\Admin\AppData\Local\Temp\aea3f087d8e73350789f82304db214d6bdd5a0785afe97ae1acf0be4cc8b9169.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3388

C:\Users\Admin\AppData\Local\Temp\aea3f087d8e73350789f82304db214d6bdd5a0785afe97ae1acf0be4cc8b9169.exe
start
2⤵
PID:3644

C:\Users\Admin\AppData\Local\Temp\aea3f087d8e73350789f82304db214d6bdd5a0785afe97ae1acf0be4cc8b9169.exe
watch
2⤵
PID:3480

memory/3388-134-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/3480-133-0x0000000000000000-mapping.dmp

Download
memory/3480-135-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/3480-138-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/3644-132-0x0000000000000000-mapping.dmp

Download
memory/3644-136-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/3644-137-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download