6b0009211cd92e1b8cf087177defea65a399d66935aafd3cced9bda23baef4ba

Analysis

max time kernel
44s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 14:25

Target

6b0009211cd92e1b8cf087177defea65a399d66935aafd3cced9bda23baef4ba.exe
Size

233KB
MD5

611b9bd7e2e74f14b64cfcd2d29ed75b
SHA1

8cdd98f7f1c5d4aeb412c3218ea41a96a5765ef2
SHA256

6b0009211cd92e1b8cf087177defea65a399d66935aafd3cced9bda23baef4ba
SHA512

02d88ec485a133630c60a5aca4a5f6fa24dc24866ed9955bec951f7a05a3cff21557d38221ae29f0d7e709f8c9b77a2175c4cc869efba79543d1869481184a68
SSDEEP

6144:xFSSZFrg1M+Br9JRMbS/qLLDMdWnpQZh9h4sC:7ZFriBrV1/qMd0QZh9u

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 1188	620	6b0009211cd92e1b8cf087177defea65a399d66935aafd3cced9bda23baef4ba.exe	27
PID 620 wrote to memory of 1188	620	6b0009211cd92e1b8cf087177defea65a399d66935aafd3cced9bda23baef4ba.exe	27
PID 620 wrote to memory of 1188	620	6b0009211cd92e1b8cf087177defea65a399d66935aafd3cced9bda23baef4ba.exe	27

C:\Users\Admin\AppData\Local\Temp\6b0009211cd92e1b8cf087177defea65a399d66935aafd3cced9bda23baef4ba.exe
"C:\Users\Admin\AppData\Local\Temp\6b0009211cd92e1b8cf087177defea65a399d66935aafd3cced9bda23baef4ba.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:620
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 388
  2⤵
  PID:1188

memory/1188-54-0x0000000000000000-mapping.dmp

Download
memory/1188-55-0x000007FEFC331000-0x000007FEFC333000-memory.dmp

Filesize
8KB

Download