7775e63aeb7f42c2112118d39e3c87d0d9618b2e83173719e9d5c2049899269e

Analysis

Target

7775e63aeb7f42c2112118d39e3c87d0d9618b2e83173719e9d5c2049899269e.exe
Size

5KB
MD5

f9d87efa9e7c1dc50fbc643eb76bb500
SHA1

bebf1e4b4824c9d87bcc846cea9352ecb632bc25
SHA256

7775e63aeb7f42c2112118d39e3c87d0d9618b2e83173719e9d5c2049899269e
SHA512

bbab0263027a4e8495c182b27b869ddbcadf76945d2f0bd8f43fe776bda211b21fda6a3318401825cc1fce6a234adb3c4b0b532a59acfbabd253b7501983ef2d

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 3352	3892	7775e63aeb7f42c2112118d39e3c87d0d9618b2e83173719e9d5c2049899269e.exe	68
PID 3892 wrote to memory of 3352	3892	7775e63aeb7f42c2112118d39e3c87d0d9618b2e83173719e9d5c2049899269e.exe	68

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3352	dw20.exe
3352	dw20.exe

C:\Users\Admin\AppData\Local\Temp\7775e63aeb7f42c2112118d39e3c87d0d9618b2e83173719e9d5c2049899269e.exe
"C:\Users\Admin\AppData\Local\Temp\7775e63aeb7f42c2112118d39e3c87d0d9618b2e83173719e9d5c2049899269e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 816
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3352

memory/3352-1-0x00000000027B0000-0x00000000027B1000-memory.dmp

Filesize
4KB

Download
memory/3352-2-0x00000000027B0000-0x00000000027B1000-memory.dmp

Filesize
4KB

Download
memory/3352-8-0x0000000002F60000-0x0000000002F61000-memory.dmp

Filesize
4KB

Download
memory/3352-9-0x0000000002F60000-0x0000000002F61000-memory.dmp

Filesize
4KB

Download
memory/3352-10-0x0000000002F60000-0x0000000002F61000-memory.dmp

Filesize
4KB

Download