02338519d0a8b780cb91c37cd7cd09aa1d4d759d1283ac573f42bd56a22cc83b

Analysis

Target
Reborn Stub.exe
Size 548KB
Sample201109-fd659pnl8a
SHA256 02338519d0a8b780cb91c37cd7cd09aa1d4d759d1283ac573f42bd56a22cc83b
MD5 60e9d24ee4b9a88db76a992c82dd37e9
SHA1 8913d4e840f0f9393563f195e151dddaa695c923
SHA512 f732b3e9ecb3a75400c41d50bd24e9a8e2c210d09163fdaefcf81210530556e8fa1e48f7444546529fb6569a0e23335ad6b06a89cd8f120507ba21b68cbe1c12
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 1228	1852	Reborn Stub.exe	26
PID 1852 wrote to memory of 1228	1852	Reborn Stub.exe	26
PID 1852 wrote to memory of 1228	1852	Reborn Stub.exe	26

C:\Users\Admin\AppData\Local\Temp\Reborn Stub.exe
"C:\Users\Admin\AppData\Local\Temp\Reborn Stub.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 384
  2⤵
  PID:1228

memory/1228-3-0x00000000021C0000-0x00000000021D1000-memory.dmp

Download

memory/1228-4-0x0000000002480000-0x0000000002491000-memory.dmp

Download

memory/1852-0-0x000007FEF55D0000-0x000007FEF5F6D000-memory.dmp

Download

memory/1852-1-0x000007FEF55D0000-0x000007FEF5F6D000-memory.dmp

Download