2a7873051114cd0835c7cefd0d75d3add290941fe6331504eababeec7fb04780

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 01:28

Target

2a7873051114cd0835c7cefd0d75d3add290941fe6331504eababeec7fb04780.exe
Size

26KB
MD5

538c276a2b498870b892a9c649242890
SHA1

2a48f06d1643beb98a31476106297f8bfd41e757
SHA256

2a7873051114cd0835c7cefd0d75d3add290941fe6331504eababeec7fb04780
SHA512

625a43c7e4360396b93fe0f47fda9f3e34b2e1a303868eb6bb452b52da674fef75abdb455aeb5d9a94afaa902107003e5167a62d9ec2b569cadefd9168b92003
SSDEEP

384:6/WCTQ5RGXEgHP+oVKRRswCXaVIC92HBVRC29MGljSnUlQCVvO:xT5RTxoVKvsZ6IfHBlNSQ/Vv

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 848	1676	2a7873051114cd0835c7cefd0d75d3add290941fe6331504eababeec7fb04780.exe	27
PID 1676 wrote to memory of 848	1676	2a7873051114cd0835c7cefd0d75d3add290941fe6331504eababeec7fb04780.exe	27
PID 1676 wrote to memory of 848	1676	2a7873051114cd0835c7cefd0d75d3add290941fe6331504eababeec7fb04780.exe	27
PID 1676 wrote to memory of 848	1676	2a7873051114cd0835c7cefd0d75d3add290941fe6331504eababeec7fb04780.exe	27

C:\Users\Admin\AppData\Local\Temp\2a7873051114cd0835c7cefd0d75d3add290941fe6331504eababeec7fb04780.exe
"C:\Users\Admin\AppData\Local\Temp\2a7873051114cd0835c7cefd0d75d3add290941fe6331504eababeec7fb04780.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 396
  2⤵
  PID:848

memory/848-55-0x0000000000000000-mapping.dmp

Download
memory/1676-54-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/1676-57-0x00000000740E0000-0x000000007468B000-memory.dmp

Filesize
5.7MB

Download
memory/1676-58-0x00000000740E0000-0x000000007468B000-memory.dmp

Filesize
5.7MB

Download