415406b919150e88f307f8fae2df5871d64d9cf0e59efd20a0ec1d23ca66ac1a

Analysis

max time kernel
30s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 13:42

Target

415406b919150e88f307f8fae2df5871d64d9cf0e59efd20a0ec1d23ca66ac1a.exe
Size

173KB
MD5

651bad77153fc1be453c8ded7e31b6f0
SHA1

5d503ee8f88ca8103cc9203937685509f172a8c8
SHA256

415406b919150e88f307f8fae2df5871d64d9cf0e59efd20a0ec1d23ca66ac1a
SHA512

0c56b6bba5f93ece5eb278c66f1f687d2b86cae1a49da7ccf66462efdb77665f2d23cb8e56e0e943a728800c77554ae67f9d20c7b5f3132f09e645c315e61ec2
SSDEEP

1536:WRUJnFahNLjo/6Cg+TyKWtv/yHL76NmWd/PF+vtqwIA7WFccR1JsFwcPYmevs05C:+waNLsHvTyKWNyX67dNstF7SxkUMp

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 1364	1556	415406b919150e88f307f8fae2df5871d64d9cf0e59efd20a0ec1d23ca66ac1a.exe	27
PID 1556 wrote to memory of 1364	1556	415406b919150e88f307f8fae2df5871d64d9cf0e59efd20a0ec1d23ca66ac1a.exe	27
PID 1556 wrote to memory of 1364	1556	415406b919150e88f307f8fae2df5871d64d9cf0e59efd20a0ec1d23ca66ac1a.exe	27
PID 1556 wrote to memory of 1364	1556	415406b919150e88f307f8fae2df5871d64d9cf0e59efd20a0ec1d23ca66ac1a.exe	27

C:\Users\Admin\AppData\Local\Temp\415406b919150e88f307f8fae2df5871d64d9cf0e59efd20a0ec1d23ca66ac1a.exe
"C:\Users\Admin\AppData\Local\Temp\415406b919150e88f307f8fae2df5871d64d9cf0e59efd20a0ec1d23ca66ac1a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 424
  2⤵
  PID:1364

memory/1556-54-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download
memory/1556-57-0x0000000075040000-0x00000000755EB000-memory.dmp

Filesize
5.7MB

Download
memory/1556-58-0x0000000075040000-0x00000000755EB000-memory.dmp

Filesize
5.7MB

Download