c69e2b418d7b7a878e274799516f1a99d52f8ece23289b646b5caf9304f7d576

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 14:28

Target

39d55aeb1e02b1c3b03face4aaf34e5b.exe
Size

76KB
MD5

39d55aeb1e02b1c3b03face4aaf34e5b
SHA1

cb31d9a8e0d372cf7fa4e5794d75d8575561d3de
SHA256

c69e2b418d7b7a878e274799516f1a99d52f8ece23289b646b5caf9304f7d576
SHA512

8839811406833d02683a1a07105f58ba48dbd9986c99226ef4fa096e1ed6d33809aab481b1b6362633a11bda609fb437ba8837401daecc29116eb20158378b98
SSDEEP

1536:rKa7z/vV1CUov74Pll6MYmaMhjR+q994YS7qQSTUQx:rKa7zXV1C7UPjlNbnL4YS7HQ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 2076	4564	39d55aeb1e02b1c3b03face4aaf34e5b.exe	88
PID 4564 wrote to memory of 2076	4564	39d55aeb1e02b1c3b03face4aaf34e5b.exe	88
PID 4564 wrote to memory of 2076	4564	39d55aeb1e02b1c3b03face4aaf34e5b.exe	88

C:\Users\Admin\AppData\Local\Temp\39d55aeb1e02b1c3b03face4aaf34e5b.exe
"C:\Users\Admin\AppData\Local\Temp\39d55aeb1e02b1c3b03face4aaf34e5b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Users\Admin\AppData\Local\Temp\39d55aeb1e02b1c3b03face4aaf34e5b.exe
  "C:\Users\Admin\AppData\Local\Temp\39d55aeb1e02b1c3b03face4aaf34e5b.exe" 351498707780664547
  2⤵
  PID:2076

memory/2076-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2076-5-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4564-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download