f2d7a94a6961ff11394d9f17d159a7e341a9127d10a60a91831115cc005936d9

Analysis

max time kernel
38s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21-10-2022 00:23

Target

f2d7a94a6961ff11394d9f17d159a7e341a9127d10a60a91831115cc005936d9.exe
Size

24KB
MD5

5b69020633eaccbb9790e4cde3d66305
SHA1

3f137718891d35f9dc9831110de19b5c89ab9dd1
SHA256

f2d7a94a6961ff11394d9f17d159a7e341a9127d10a60a91831115cc005936d9
SHA512

0cb15ff01f059be5c6c8b991ae6c4be8dfb7c5fcb9372a36a2f5b89487fe7f5fdcb2fa6b59fd2e757dca38aa9427c23280c0254500c63f0f2961adbdb6a2140a
SSDEEP

192:gQZdUz3uv0mST8iKHBaLR82AsVTUHzI9eAfdC6Z/rT1SNwJ:gQLUz+pUMwN7AsyHaeSZ/tSNwJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1308	1492	f2d7a94a6961ff11394d9f17d159a7e341a9127d10a60a91831115cc005936d9.exe	28
PID 1492 wrote to memory of 1308	1492	f2d7a94a6961ff11394d9f17d159a7e341a9127d10a60a91831115cc005936d9.exe	28
PID 1492 wrote to memory of 1308	1492	f2d7a94a6961ff11394d9f17d159a7e341a9127d10a60a91831115cc005936d9.exe	28

C:\Users\Admin\AppData\Local\Temp\f2d7a94a6961ff11394d9f17d159a7e341a9127d10a60a91831115cc005936d9.exe
"C:\Users\Admin\AppData\Local\Temp\f2d7a94a6961ff11394d9f17d159a7e341a9127d10a60a91831115cc005936d9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 392
  2⤵
  PID:1308

memory/1308-54-0x0000000000000000-mapping.dmp

Download
memory/1308-55-0x000007FEFC291000-0x000007FEFC293000-memory.dmp

Filesize
8KB

Download