06c26459844cc452ae5a9ff7e493723691bddd625d45d02c5452bd3a38d28cdd

Analysis

max time kernel
38s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08/09/2022, 13:46

Target

1 06c26459844cc452ae5a9ff7e493723691bddd625d45d02c5452bd3a38d28cdd.exe
Size

209KB
MD5

9261b8a5f0ac5cd91b83069754df7ad0
SHA1

5ce12314bd859b35b9f10c5c600e3929b950ff19
SHA256

06c26459844cc452ae5a9ff7e493723691bddd625d45d02c5452bd3a38d28cdd
SHA512

a1efa1c19031cc4ac44188056e0044f17449245131b803e0403ac36997a64a356a0d196deb4b3cbe10cc0d1591f666a96b568614fa1f0412bac057fae6f21149
SSDEEP

3072:Dcp2M3ReEWHOzsS1XHjoFVvofVEUhPi3F2TB5/LS3RZtlPKnf6s6e/haRex:wpLV1XHj4iOUxi3FwO3rKnXpa

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 832	1444	1 06c26459844cc452ae5a9ff7e493723691bddd625d45d02c5452bd3a38d28cdd.exe	26
PID 1444 wrote to memory of 832	1444	1 06c26459844cc452ae5a9ff7e493723691bddd625d45d02c5452bd3a38d28cdd.exe	26
PID 1444 wrote to memory of 832	1444	1 06c26459844cc452ae5a9ff7e493723691bddd625d45d02c5452bd3a38d28cdd.exe	26
PID 1444 wrote to memory of 832	1444	1 06c26459844cc452ae5a9ff7e493723691bddd625d45d02c5452bd3a38d28cdd.exe	26

C:\Users\Admin\AppData\Local\Temp\1 06c26459844cc452ae5a9ff7e493723691bddd625d45d02c5452bd3a38d28cdd.exe
"C:\Users\Admin\AppData\Local\Temp\1 06c26459844cc452ae5a9ff7e493723691bddd625d45d02c5452bd3a38d28cdd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 424
  2⤵
  PID:832

memory/1444-54-0x0000000075041000-0x0000000075043000-memory.dmp

Filesize
8KB

Download
memory/1444-56-0x0000000074550000-0x0000000074AFB000-memory.dmp

Filesize
5.7MB

Download
memory/1444-58-0x0000000074550000-0x0000000074AFB000-memory.dmp

Filesize
5.7MB

Download