0830da14cc1c0dba3fbc0c3840944dfb31af000b126821236a0b27e7d202667e

Analysis

max time kernel
42s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
13-10-2022 17:44

Target

0830da14cc1c0dba3fbc0c3840944dfb31af000b126821236a0b27e7d202667e.exe
Size

199KB
MD5

6510e9d7648db531b34aa9e3798d48e0
SHA1

1e4e26c63da0af34ed19cc23a4dc73708fcd6583
SHA256

0830da14cc1c0dba3fbc0c3840944dfb31af000b126821236a0b27e7d202667e
SHA512

3ab92ab7ccc54033b6be3130ee906272cada4a4ddc2fd58436c12c99bfa1df96f292b013bb6e627606aeb1a85c0dffcf0e46606e230ba058bef7c22acf647150
SSDEEP

3072:wGGzj9akU4+JvhHgTmJxdxxxxxx0DlgGGDG1l6JnZ/diAgpQdOhwzV:01ab7Jvh0gGaGlsZF1gp25

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0830da14cc1c0dba3fbc0c3840944dfb31af000b126821236a0b27e7d202667e.exe

description	pid	process	target process
PID 1028 wrote to memory of 1372	1028	0830da14cc1c0dba3fbc0c3840944dfb31af000b126821236a0b27e7d202667e.exe	dw20.exe
PID 1028 wrote to memory of 1372	1028	0830da14cc1c0dba3fbc0c3840944dfb31af000b126821236a0b27e7d202667e.exe	dw20.exe
PID 1028 wrote to memory of 1372	1028	0830da14cc1c0dba3fbc0c3840944dfb31af000b126821236a0b27e7d202667e.exe	dw20.exe
PID 1028 wrote to memory of 1372	1028	0830da14cc1c0dba3fbc0c3840944dfb31af000b126821236a0b27e7d202667e.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\0830da14cc1c0dba3fbc0c3840944dfb31af000b126821236a0b27e7d202667e.exe
"C:\Users\Admin\AppData\Local\Temp\0830da14cc1c0dba3fbc0c3840944dfb31af000b126821236a0b27e7d202667e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1028

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 424
2⤵
PID:1372

memory/1028-54-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download
memory/1028-57-0x0000000073F70000-0x000000007451B000-memory.dmp

Filesize
5.7MB

Download
memory/1028-58-0x0000000073F70000-0x000000007451B000-memory.dmp

Filesize
5.7MB

Download
memory/1372-55-0x0000000000000000-mapping.dmp

Download