4da28a79aaf7a723403bd7813467a4254bb63980668bcd63d5108b7e34a67b48

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 02:27

Target

4da28a79aaf7a723403bd7813467a4254bb63980668bcd63d5108b7e34a67b48.exe
Size

7KB
MD5

268dc9b8698e4cf8d5dc70d84db33a15
SHA1

3620551c8c18e8371142815be3530c8b7895f284
SHA256

4da28a79aaf7a723403bd7813467a4254bb63980668bcd63d5108b7e34a67b48
SHA512

afb440727bf2dbec015ad4741e2b98253c9bc021d73a77f1a7f087b6b81ed21361255378d3377bbfe69e6208b34b5b8ebedc52d8b2720257816df44af3076a30
SSDEEP

192:jLgFUY9GXdaLiAYV5ARtVEnlYJLVLTiJlndq:jLqUCMdaLiAYMrhLTilq

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 960	912	4da28a79aaf7a723403bd7813467a4254bb63980668bcd63d5108b7e34a67b48.exe	28
PID 912 wrote to memory of 960	912	4da28a79aaf7a723403bd7813467a4254bb63980668bcd63d5108b7e34a67b48.exe	28
PID 912 wrote to memory of 960	912	4da28a79aaf7a723403bd7813467a4254bb63980668bcd63d5108b7e34a67b48.exe	28
PID 912 wrote to memory of 960	912	4da28a79aaf7a723403bd7813467a4254bb63980668bcd63d5108b7e34a67b48.exe	28

C:\Users\Admin\AppData\Local\Temp\4da28a79aaf7a723403bd7813467a4254bb63980668bcd63d5108b7e34a67b48.exe
"C:\Users\Admin\AppData\Local\Temp\4da28a79aaf7a723403bd7813467a4254bb63980668bcd63d5108b7e34a67b48.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 428
  2⤵
  PID:960

memory/912-54-0x0000000076091000-0x0000000076093000-memory.dmp

Filesize
8KB

Download
memory/912-57-0x00000000744B0000-0x0000000074A5B000-memory.dmp

Filesize
5.7MB

Download
memory/912-58-0x00000000744B0000-0x0000000074A5B000-memory.dmp

Filesize
5.7MB

Download