2f633f57a5c500d57dc3d42861eb0a30c4ed617525a576946d3af9800bf23bbf

Analysis

max time kernel
153s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
02-11-2023 13:14

Target

Pcreateproc.exe
Size

6KB
MD5

40714e24c87686d04c188ffa9f269ca3
SHA1

7cd19de47ef42ae393a283863d98962a42788b01
SHA256

2f633f57a5c500d57dc3d42861eb0a30c4ed617525a576946d3af9800bf23bbf
SHA512

bd3e4118f586d435fc4f58f3a9823137095ca8726587090df0ee895d817062c23a128a90100e74a507f24274ea1925130e67656105987b8e735b00b3f8546fd8
SSDEEP

48:6VJktLAUru6jz0h46r2BHsiFeS3gbZ/vFMpuA+NAxc4PWe2a0xi/254td4lR0AUB:3UUru6jz0C7HnC3KDPWe2LxXAezNt

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 1152	3028	Pcreateproc.exe	87
PID 3028 wrote to memory of 1152	3028	Pcreateproc.exe	87

C:\Users\Admin\AppData\Local\Temp\Pcreateproc.exe
"C:\Users\Admin\AppData\Local\Temp\Pcreateproc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:1152

memory/3028-0-0x0000000000AE0000-0x0000000000AE8000-memory.dmp

Filesize
32KB

Download
memory/3028-2-0x00007FFE25E20000-0x00007FFE268E1000-memory.dmp

Filesize
10.8MB

Download
memory/3028-3-0x00007FFE25E20000-0x00007FFE268E1000-memory.dmp

Filesize
10.8MB

Download