144455de43d7ba3aa9f0a7b6f0854d8f60fb419ed68eaea213fdbe8db53a9f30

Analysis

max time kernel
140s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
07/07/2023, 12:32

Target

49af32d79deeb7exeexeexeex.exe
Size

342KB
MD5

49af32d79deeb759d0571722233c913b
SHA1

5743a4cab9cd5563a1a4fe9c3c269ecc06e65702
SHA256

144455de43d7ba3aa9f0a7b6f0854d8f60fb419ed68eaea213fdbe8db53a9f30
SHA512

48f4e3f074baae21e947a3d66e49a172ee4d85101a265015d7f4e5bedc3562d206bcb4308b4f80a231f9e527cca06c52e46edf3d5cbb79cc9b50e8dc5dfda0b2
SSDEEP

6144:ygNYi0KqlI9QBXUaN99dDBdkP05AUFuCWdRSJTBqdiGZRmC:RYi0qQ7p/dW05zfWXSJTsdiGZl

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 3436	1476	49af32d79deeb7exeexeexeex.exe	84
PID 1476 wrote to memory of 3436	1476	49af32d79deeb7exeexeexeex.exe	84
PID 1476 wrote to memory of 3436	1476	49af32d79deeb7exeexeexeex.exe	84

C:\Users\Admin\AppData\Local\Temp\49af32d79deeb7exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\49af32d79deeb7exeexeexeex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:3436