0156e2b5a4642baaa1709bb1add10b8c0d1ae872488ff6845b7fd3f7c3a1b02f

Analysis

max time kernel
37s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 08:31

Target

0156e2b5a4642baaa1709bb1add10b8c0d1ae872488ff6845b7fd3f7c3a1b02f.exe
Size

252KB
MD5

6daad8978b70c8c38efd5d0702dfdc50
SHA1

7338e209b90040f994090e647839e44ec48c6f8d
SHA256

0156e2b5a4642baaa1709bb1add10b8c0d1ae872488ff6845b7fd3f7c3a1b02f
SHA512

859454db4cd683ffc1315822a8d71a7a03cf4a82e161299ff45e3ca174b2ead18a4aa91c1a78bb02daac390eed43f4028b1dece12aaf1dc478b6cf90fb03ecc9
SSDEEP

6144:5poggTCewtqOX/O63MOBQ6geWWmmpcdhWSV/M:A7TVOhVBLTpcXVM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 968	1516	0156e2b5a4642baaa1709bb1add10b8c0d1ae872488ff6845b7fd3f7c3a1b02f.exe	27
PID 1516 wrote to memory of 968	1516	0156e2b5a4642baaa1709bb1add10b8c0d1ae872488ff6845b7fd3f7c3a1b02f.exe	27
PID 1516 wrote to memory of 968	1516	0156e2b5a4642baaa1709bb1add10b8c0d1ae872488ff6845b7fd3f7c3a1b02f.exe	27

C:\Users\Admin\AppData\Local\Temp\0156e2b5a4642baaa1709bb1add10b8c0d1ae872488ff6845b7fd3f7c3a1b02f.exe
"C:\Users\Admin\AppData\Local\Temp\0156e2b5a4642baaa1709bb1add10b8c0d1ae872488ff6845b7fd3f7c3a1b02f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 388
  2⤵
  PID:968

memory/968-55-0x000007FEFBC01000-0x000007FEFBC03000-memory.dmp

Filesize
8KB

Download