aea9ff80a825862b16a8aa0729b6b8fd73f11fc347709b3d5c00f4b27f6d930f

Analysis

max time kernel
47s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 08:17

Target

aea9ff80a825862b16a8aa0729b6b8fd73f11fc347709b3d5c00f4b27f6d930f.exe
Size

324KB
MD5

815abf7fa5f94fed6d5242691fbdcfa0
SHA1

78baa96a5af848c2ce36deaf9bafb288d07d9be3
SHA256

aea9ff80a825862b16a8aa0729b6b8fd73f11fc347709b3d5c00f4b27f6d930f
SHA512

151bf0ef902f613636b366a531999fe196582f2f12c54111b2c9919d791161166adade552a9729e3c14964a9fa7b178908410d210bbf54b9212eb073af6f6dcf
SSDEEP

6144:iISqe4OoBwuVTIt4dzX3btp/xwm8DFKda8KyLAZ9zE:iIdTBhE2dz7Xdg8Lg

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1180	1724	aea9ff80a825862b16a8aa0729b6b8fd73f11fc347709b3d5c00f4b27f6d930f.exe	27
PID 1724 wrote to memory of 1180	1724	aea9ff80a825862b16a8aa0729b6b8fd73f11fc347709b3d5c00f4b27f6d930f.exe	27
PID 1724 wrote to memory of 1180	1724	aea9ff80a825862b16a8aa0729b6b8fd73f11fc347709b3d5c00f4b27f6d930f.exe	27
PID 1724 wrote to memory of 1180	1724	aea9ff80a825862b16a8aa0729b6b8fd73f11fc347709b3d5c00f4b27f6d930f.exe	27

C:\Users\Admin\AppData\Local\Temp\aea9ff80a825862b16a8aa0729b6b8fd73f11fc347709b3d5c00f4b27f6d930f.exe
"C:\Users\Admin\AppData\Local\Temp\aea9ff80a825862b16a8aa0729b6b8fd73f11fc347709b3d5c00f4b27f6d930f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 424
  2⤵
  PID:1180

memory/1724-54-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Filesize
8KB

Download
memory/1724-57-0x00000000742C0000-0x000000007486B000-memory.dmp

Filesize
5.7MB

Download
memory/1724-58-0x00000000742C0000-0x000000007486B000-memory.dmp

Filesize
5.7MB

Download