049b17fa232a9ccdbc78266e53b687d4dcf0dfbee8687da74f86342af1a5d95c

Analysis

max time kernel
39s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 12:39

Target

049b17fa232a9ccdbc78266e53b687d4dcf0dfbee8687da74f86342af1a5d95c.exe
Size

819KB
MD5

81b6a6894eb9ba476ae9975d4fcbfba0
SHA1

d2a86d936e14b9fbcf98edce5c0e03bdbbec1428
SHA256

049b17fa232a9ccdbc78266e53b687d4dcf0dfbee8687da74f86342af1a5d95c
SHA512

4ae5c9c1807e2d59a4925bf616d8e601289fadc2766b799372e70fbd9b980241aa0de693d8b9444a0f76be79e5229603c643a0441c38fa527a75557eab54daf2
SSDEEP

12288:JWViH6ZjMLDicX3SqMh63Xm089aMBQTSdwIHfE:JqyzHSBh6L89aGQTSaUc

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 896	1956	049b17fa232a9ccdbc78266e53b687d4dcf0dfbee8687da74f86342af1a5d95c.exe	28
PID 1956 wrote to memory of 896	1956	049b17fa232a9ccdbc78266e53b687d4dcf0dfbee8687da74f86342af1a5d95c.exe	28
PID 1956 wrote to memory of 896	1956	049b17fa232a9ccdbc78266e53b687d4dcf0dfbee8687da74f86342af1a5d95c.exe	28

C:\Users\Admin\AppData\Local\Temp\049b17fa232a9ccdbc78266e53b687d4dcf0dfbee8687da74f86342af1a5d95c.exe
"C:\Users\Admin\AppData\Local\Temp\049b17fa232a9ccdbc78266e53b687d4dcf0dfbee8687da74f86342af1a5d95c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 404
  2⤵
  PID:896

memory/896-56-0x000007FEFBF21000-0x000007FEFBF23000-memory.dmp

Filesize
8KB

Download
memory/1956-54-0x000007FEF3B30000-0x000007FEF4553000-memory.dmp

Filesize
10.1MB

Download