0c6ddc57621f245d2516d8ea0618296bf2a2808af9fe14f1bdb3619be3856b4e

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21/10/2022, 01:27

Target

0c6ddc57621f245d2516d8ea0618296bf2a2808af9fe14f1bdb3619be3856b4e.exe
Size

303KB
MD5

5ee4886e736a0f578acba881e67fc3cc
SHA1

3e4a021b868c55fdc827d7a7d04d565f5ed095d6
SHA256

0c6ddc57621f245d2516d8ea0618296bf2a2808af9fe14f1bdb3619be3856b4e
SHA512

67285a9c3201356d638651498cc26dbff00685f68beb9b8375c23314f226cadcafc90fd4d07edf9afa366eff31caa79afc63fc568d8ee52d1c6604305b5007ab
SSDEEP

6144:ijIjDk1yKvYZwymUpnelqpUVKDY4uRmO7e+wKjv8bR3CH4keHO43eXC0wnK/e0:pDgyKvQlmUFelqpUV8YRmOiCQZ24pB3k

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 884	1392	0c6ddc57621f245d2516d8ea0618296bf2a2808af9fe14f1bdb3619be3856b4e.exe	28
PID 1392 wrote to memory of 884	1392	0c6ddc57621f245d2516d8ea0618296bf2a2808af9fe14f1bdb3619be3856b4e.exe	28
PID 1392 wrote to memory of 884	1392	0c6ddc57621f245d2516d8ea0618296bf2a2808af9fe14f1bdb3619be3856b4e.exe	28

C:\Users\Admin\AppData\Local\Temp\0c6ddc57621f245d2516d8ea0618296bf2a2808af9fe14f1bdb3619be3856b4e.exe
"C:\Users\Admin\AppData\Local\Temp\0c6ddc57621f245d2516d8ea0618296bf2a2808af9fe14f1bdb3619be3856b4e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 384
  2⤵
  PID:884

memory/884-57-0x000007FEFBA81000-0x000007FEFBA83000-memory.dmp

Filesize
8KB

Download
memory/1392-54-0x000007FEF40A0000-0x000007FEF4AC3000-memory.dmp

Filesize
10.1MB

Download
memory/1392-55-0x000007FEF2BB0000-0x000007FEF3C46000-memory.dmp

Filesize
16.6MB

Download