52c9db1031f4990c420bcb064225ced0d83223a276bef3f12260f506b756b97e

Analysis

max time kernel
130s
max time network
181s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-09-2022 19:39

Target

52c9db1031f4990c420bcb064225ced0d83223a276bef3f12260f506b756b97e.exe
Size

30KB
MD5

1af0e7e0f8a83e2b84931d2d1905aeae
SHA1

e6519be1cf70e1ab808a694291e32041f2d7ca52
SHA256

52c9db1031f4990c420bcb064225ced0d83223a276bef3f12260f506b756b97e
SHA512

93e49590e3ff8c26e26be5491504c2a1bd8dbb16b9bdb65939383d923be235fa3c85da114421993419021111a4ff438874ecc54a669b4309fc5dbb5beb2b0e3d
SSDEEP

768:zw7i8b4El9AflvOWOiogOGVmoXoyWdpNX1QDT:zw7FMcOVZFtFAFA/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 2012	1480	52c9db1031f4990c420bcb064225ced0d83223a276bef3f12260f506b756b97e.exe	27
PID 1480 wrote to memory of 2012	1480	52c9db1031f4990c420bcb064225ced0d83223a276bef3f12260f506b756b97e.exe	27
PID 1480 wrote to memory of 2012	1480	52c9db1031f4990c420bcb064225ced0d83223a276bef3f12260f506b756b97e.exe	27

C:\Users\Admin\AppData\Local\Temp\52c9db1031f4990c420bcb064225ced0d83223a276bef3f12260f506b756b97e.exe
"C:\Users\Admin\AppData\Local\Temp\52c9db1031f4990c420bcb064225ced0d83223a276bef3f12260f506b756b97e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 908
  2⤵
  PID:2012

memory/1480-54-0x000007FEF49F0000-0x000007FEF5413000-memory.dmp

Filesize
10.1MB

Download
memory/2012-56-0x000007FEFC4E1000-0x000007FEFC4E3000-memory.dmp

Filesize
8KB

Download