41c4fbd9c7b2362b09ed123b6c48491fbc4a121dadd177619c83b69a7c2ff51e

Analysis

Target
Purchase Order.exe
Size 209KB
Sample220705-bnyepsefa3
SHA256 41c4fbd9c7b2362b09ed123b6c48491fbc4a121dadd177619c83b69a7c2ff51e
MD5 cac466f0ebe134a45bc6dc73dd9d77b5
SHA1 d0bb4af1b307b5ce459200db425dfe20a32628a0
SHA512 13122b6f14ed1a1e95425f1377f9e5c488b44ce8b3238e64e4d6268f1de3fb3272bb2c2725ef2006987e64e1b0c127e0cf7106785f02add35107dd10bc4e8ea0
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 1272	1000	Purchase Order.exe	27
PID 1000 wrote to memory of 1272	1000	Purchase Order.exe	27
PID 1000 wrote to memory of 1272	1000	Purchase Order.exe	27
PID 1000 wrote to memory of 1272	1000	Purchase Order.exe	27

C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 424
  2⤵
  PID:1272

memory/1000-54-0x0000000075F21000-0x0000000075F23000-memory.dmp

Download

memory/1000-55-0x0000000074D60000-0x000000007530B000-memory.dmp

Download

memory/1000-58-0x0000000074D60000-0x000000007530B000-memory.dmp

Download