3fe578e263f4d9ba02f9cbf1f8d4cbf03e9525ebe4045a30df9ca1242f48c2d5

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21/10/2022, 00:34

Target

3fe578e263f4d9ba02f9cbf1f8d4cbf03e9525ebe4045a30df9ca1242f48c2d5.exe
Size

988KB
MD5

53e2cd86fddaaf75693699a8109911d0
SHA1

456489825f99217d69e0e4761e6b0d9fab8d945f
SHA256

3fe578e263f4d9ba02f9cbf1f8d4cbf03e9525ebe4045a30df9ca1242f48c2d5
SHA512

83066284803a683e50384f4b2f70aade8da8db293e427dce9eed8e3ba81b3daeddee3bae51b22d742813a8ae13dea389912057d2449f421a8968544021bbd510
SSDEEP

12288:/yELQDEI04EAihYHfXOJc3pW0MIVABelmZNZRaEpD:6ELQpYrc3pW0P6BelM/x

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 1488	1372	3fe578e263f4d9ba02f9cbf1f8d4cbf03e9525ebe4045a30df9ca1242f48c2d5.exe	29
PID 1372 wrote to memory of 1488	1372	3fe578e263f4d9ba02f9cbf1f8d4cbf03e9525ebe4045a30df9ca1242f48c2d5.exe	29
PID 1372 wrote to memory of 1488	1372	3fe578e263f4d9ba02f9cbf1f8d4cbf03e9525ebe4045a30df9ca1242f48c2d5.exe	29
PID 1372 wrote to memory of 1488	1372	3fe578e263f4d9ba02f9cbf1f8d4cbf03e9525ebe4045a30df9ca1242f48c2d5.exe	29

C:\Users\Admin\AppData\Local\Temp\3fe578e263f4d9ba02f9cbf1f8d4cbf03e9525ebe4045a30df9ca1242f48c2d5.exe
"C:\Users\Admin\AppData\Local\Temp\3fe578e263f4d9ba02f9cbf1f8d4cbf03e9525ebe4045a30df9ca1242f48c2d5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 432
  2⤵
  PID:1488

memory/1372-54-0x0000000075921000-0x0000000075923000-memory.dmp

Filesize
8KB

Download
memory/1372-57-0x0000000074CA0000-0x000000007524B000-memory.dmp

Filesize
5.7MB

Download
memory/1372-58-0x0000000074CA0000-0x000000007524B000-memory.dmp

Filesize
5.7MB

Download