dd61ac8cd411106cef32fbc71827d92609ccfb3941e70294badbb07910e4b700

Analysis

max time kernel
135s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
14/04/2023, 06:59

Target
0e85f16ce97abd536a94a989124645aa.exe
Size 6.3MB
Sample230414-hr4t8aac4s
SHA256 dd61ac8cd411106cef32fbc71827d92609ccfb3941e70294badbb07910e4b700
MD5 0e85f16ce97abd536a94a989124645aa
SHA1 7ea194750ed5178634cd2e70253c224350ecd1b5
SHA512 14c5adfc03315d3c2fb8033ab892614a07433cf83fc1169f2135cad298be4fc649c21be897fb7b5b7828af69cc8313b2b41e579d76009e49371ae6da805ce081
SSDEEP 196608:h9DNr558bhV8dkwDsiBGAa3cXJ+yX3Gt2UlWt9G5SkKf:h9DNFabhV8d9LNJ+y3k2woJf
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 4164	648	0e85f16ce97abd536a94a989124645aa.exe	85
PID 648 wrote to memory of 4164	648	0e85f16ce97abd536a94a989124645aa.exe	85

C:\Users\Admin\AppData\Local\Temp\0e85f16ce97abd536a94a989124645aa.exe
"C:\Users\Admin\AppData\Local\Temp\0e85f16ce97abd536a94a989124645aa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:648
- C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\0e85f16ce97abd536a94a989124645aa.exe"
  2⤵
  PID:4164

memory/648-133-0x0000000000400000-0x0000000000440000-memory.dmp

Download