aa2ec664326c7892a144cb294c20ae0497f86bbb8a65bceeb966ca1cf8d80578

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/12/2023, 21:48

Target

fa824be9f6135ab3c46fab4c3df5999f.exe
Size

96KB
MD5

fa824be9f6135ab3c46fab4c3df5999f
SHA1

5509db1a8a5c8a80d90306a20aa0bbcb399786c0
SHA256

aa2ec664326c7892a144cb294c20ae0497f86bbb8a65bceeb966ca1cf8d80578
SHA512

75b0f6c48e2a1a0bd1b9413170e2978a31c8cafacdc19305426b732ab1d7bcc977d36c1ae6a7e6c9c2d9a8739cf242dfe43ed0cb3c18ed711a727f7a2ca154dc
SSDEEP

1536:yFU0a86GsF/MiBPJz0iuzFTmT0dY/ozMZdkINxZsri/kykXW3LQgi:ATkfPeiuoT07MZuINxyri/nkG3LRi

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 512	1932	fa824be9f6135ab3c46fab4c3df5999f.exe	17
PID 1932 wrote to memory of 512	1932	fa824be9f6135ab3c46fab4c3df5999f.exe	17
PID 1932 wrote to memory of 512	1932	fa824be9f6135ab3c46fab4c3df5999f.exe	17

C:\Users\Admin\AppData\Local\Temp\fa824be9f6135ab3c46fab4c3df5999f.exe
"C:\Users\Admin\AppData\Local\Temp\fa824be9f6135ab3c46fab4c3df5999f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Users\Admin\AppData\Local\Temp\fa824be9f6135ab3c46fab4c3df5999f.exe
  "C:\Users\Admin\AppData\Local\Temp\fa824be9f6135ab3c46fab4c3df5999f.exe" 4085573936675475920
  2⤵
  PID:512

memory/512-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/512-5-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1932-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download