9f02316f05259bbd28a9eed586000e63023695b16c2e56dc09dacc02e8ad3fa2

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 10:22

Target

16df139e5c6f71c1f089a98ee1489fa5.exe
Size

164KB
MD5

16df139e5c6f71c1f089a98ee1489fa5
SHA1

5a6d2a0fc1b1dd8e1b4065557512759c011e4a0e
SHA256

9f02316f05259bbd28a9eed586000e63023695b16c2e56dc09dacc02e8ad3fa2
SHA512

98983dca5b6573aabd2bf6b08cf695fd5d848aa543e0a59c89356d03f30b62cfea93ddbcf8bc3360734cf6af2f42c20882d550ead26be47b707ae46142707b25
SSDEEP

3072:bPFjAL0u7SxWqbavyf1swKoWcPq0dvpKKEwJsNXZkJ0fN9diMUg8kJhOUvwrhUN9:bPFjALh+xF+6LNpKnIsNbbsMUg8kD

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 2692	1788	16df139e5c6f71c1f089a98ee1489fa5.exe	16
PID 1788 wrote to memory of 2692	1788	16df139e5c6f71c1f089a98ee1489fa5.exe	16
PID 1788 wrote to memory of 2692	1788	16df139e5c6f71c1f089a98ee1489fa5.exe	16

C:\Users\Admin\AppData\Local\Temp\16df139e5c6f71c1f089a98ee1489fa5.exe
"C:\Users\Admin\AppData\Local\Temp\16df139e5c6f71c1f089a98ee1489fa5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Users\Admin\AppData\Local\Temp\16df139e5c6f71c1f089a98ee1489fa5.exe
  "C:\Users\Admin\AppData\Local\Temp\16df139e5c6f71c1f089a98ee1489fa5.exe" 1195782685496511106
  2⤵
  PID:2692

memory/1788-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2692-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2692-5-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download