ab997769f881a02a5d0b2d6978d17fb6906950e0ca503ce2d11878c31048d339

Analysis

max time kernel
35s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 17:53

Target

ab997769f881a02a5d0b2d6978d17fb6906950e0ca503ce2d11878c31048d339.exe
Size

1.7MB
MD5

03effcd7d55276b42e188352f18650a0
SHA1

d2eefe1dfcdabb16e55332c101fa64fec23383fb
SHA256

ab997769f881a02a5d0b2d6978d17fb6906950e0ca503ce2d11878c31048d339
SHA512

04bc58c886f891ad04b59b9199cf40a64cf4fc63d6d5c055b151b005465aaae92d1175d47f90483c734033470f239c1970c3051e971d9cc8a3e95c42bcf2ead3
SSDEEP

24576:uzEhNisMOrlqpNkmGypBKlsQCW+wsDaQw6DDz3qRyPnmGfrnvVUKueY8RmneWtJc:l9MBKWasY6DwOBfrnvV7UeWtQZok

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 1276	1452	ab997769f881a02a5d0b2d6978d17fb6906950e0ca503ce2d11878c31048d339.exe	26
PID 1452 wrote to memory of 1276	1452	ab997769f881a02a5d0b2d6978d17fb6906950e0ca503ce2d11878c31048d339.exe	26
PID 1452 wrote to memory of 1276	1452	ab997769f881a02a5d0b2d6978d17fb6906950e0ca503ce2d11878c31048d339.exe	26
PID 1452 wrote to memory of 1276	1452	ab997769f881a02a5d0b2d6978d17fb6906950e0ca503ce2d11878c31048d339.exe	26

C:\Users\Admin\AppData\Local\Temp\ab997769f881a02a5d0b2d6978d17fb6906950e0ca503ce2d11878c31048d339.exe
"C:\Users\Admin\AppData\Local\Temp\ab997769f881a02a5d0b2d6978d17fb6906950e0ca503ce2d11878c31048d339.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 424
  2⤵
  PID:1276

memory/1452-54-0x0000000075041000-0x0000000075043000-memory.dmp

Filesize
8KB

Download
memory/1452-55-0x0000000074550000-0x0000000074AFB000-memory.dmp

Filesize
5.7MB

Download
memory/1452-58-0x0000000074550000-0x0000000074AFB000-memory.dmp

Filesize
5.7MB

Download