49363fabed66cce2f2045aaf6d99fa1ee7821139672ce8183bacfe85a028eaa5

Analysis

max time kernel
149s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 23:35

Target

202f8401fc8bc3aba1fad4e5622988d1.exe
Size

14KB
MD5

202f8401fc8bc3aba1fad4e5622988d1
SHA1

73dfe07c231b5c30544f978991a545c148226a9a
SHA256

49363fabed66cce2f2045aaf6d99fa1ee7821139672ce8183bacfe85a028eaa5
SHA512

c29cbdb31e295f9946b1aaf2d83d3a9206440f156f0acd12dea5344e0da3ffd997765eaa0dd5fe39e43965d3db2346082482f533ca295a462321f36576146bfc
SSDEEP

192:nP461A/0LiwxqfKD6Vk/gqWhiQ7SV92sGNliwKQjcW8u7b:Qx0iwxqsRQmV92tlaAzb7b

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 1540	3004	202f8401fc8bc3aba1fad4e5622988d1.exe	92
PID 3004 wrote to memory of 1540	3004	202f8401fc8bc3aba1fad4e5622988d1.exe	92
PID 3004 wrote to memory of 1540	3004	202f8401fc8bc3aba1fad4e5622988d1.exe	92

C:\Users\Admin\AppData\Local\Temp\202f8401fc8bc3aba1fad4e5622988d1.exe
"C:\Users\Admin\AppData\Local\Temp\202f8401fc8bc3aba1fad4e5622988d1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:1540

memory/3004-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3004-1-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download