284a0496dcf15de45347bfd3318ad94cac45fea7f0f4f0aa51f31cd5eaa09487

Analysis

max time kernel
37s
max time network
50s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 22:52

Target

284a0496dcf15de45347bfd3318ad94cac45fea7f0f4f0aa51f31cd5eaa09487.exe
Size

216KB
MD5

68526f48c8f6fb7c134ebd17061ab150
SHA1

52464f9ce9240928acf227f1e71c69bc2a86285d
SHA256

284a0496dcf15de45347bfd3318ad94cac45fea7f0f4f0aa51f31cd5eaa09487
SHA512

4eb770d4f9ad19c385c219b7c7d1c3809b5245c7abf80629f8a7c9d3509ff422427f9cc4b5640cbb29f5d0a5d9f190467f782074feee654982bf1280513aa96b
SSDEEP

6144:M6s8mO/gdctpORhU7Cm/Ws0L6NFXnWc3kF:VpmO4YpchYP/ZfNQ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 1744	1988	284a0496dcf15de45347bfd3318ad94cac45fea7f0f4f0aa51f31cd5eaa09487.exe	28
PID 1988 wrote to memory of 1744	1988	284a0496dcf15de45347bfd3318ad94cac45fea7f0f4f0aa51f31cd5eaa09487.exe	28
PID 1988 wrote to memory of 1744	1988	284a0496dcf15de45347bfd3318ad94cac45fea7f0f4f0aa51f31cd5eaa09487.exe	28

C:\Users\Admin\AppData\Local\Temp\284a0496dcf15de45347bfd3318ad94cac45fea7f0f4f0aa51f31cd5eaa09487.exe
"C:\Users\Admin\AppData\Local\Temp\284a0496dcf15de45347bfd3318ad94cac45fea7f0f4f0aa51f31cd5eaa09487.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 400
  2⤵
  PID:1744

memory/1744-56-0x000007FEFB741000-0x000007FEFB743000-memory.dmp

Filesize
8KB

Download
memory/1988-54-0x000007FEF33C0000-0x000007FEF3DE3000-memory.dmp

Filesize
10.1MB

Download