f3dc53aa28db14fa73df8b245dda89ea615021e59e1bc80019068ce11c7bbefc

Analysis

max time kernel
32s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 21:45

Target

f3dc53aa28db14fa73df8b245dda89ea615021e59e1bc80019068ce11c7bbefc.exe
Size

279KB
MD5

84241df5d0516720b6c1a9df7de432a0
SHA1

5aac12d7e8d093ea050d336d41093d635775c0f6
SHA256

f3dc53aa28db14fa73df8b245dda89ea615021e59e1bc80019068ce11c7bbefc
SHA512

3dbab923c9fa36c7f3566ede3ae851ce0cbdb5148836e29009da86a698ad281659e962535bfe607b9ebd3df41625692c351705e6ca55c90f702c8b0962d435f3
SSDEEP

6144:DCC2F8NXC796TB9vj48I+kfy2KBSTpBCHF+5tEB7:D8eVQkTrvj4mkfy1Sn6Ss7

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 112	1388	f3dc53aa28db14fa73df8b245dda89ea615021e59e1bc80019068ce11c7bbefc.exe	26
PID 1388 wrote to memory of 112	1388	f3dc53aa28db14fa73df8b245dda89ea615021e59e1bc80019068ce11c7bbefc.exe	26
PID 1388 wrote to memory of 112	1388	f3dc53aa28db14fa73df8b245dda89ea615021e59e1bc80019068ce11c7bbefc.exe	26
PID 1388 wrote to memory of 112	1388	f3dc53aa28db14fa73df8b245dda89ea615021e59e1bc80019068ce11c7bbefc.exe	26

C:\Users\Admin\AppData\Local\Temp\f3dc53aa28db14fa73df8b245dda89ea615021e59e1bc80019068ce11c7bbefc.exe
"C:\Users\Admin\AppData\Local\Temp\f3dc53aa28db14fa73df8b245dda89ea615021e59e1bc80019068ce11c7bbefc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 520
  2⤵
  PID:112

memory/112-59-0x0000000000000000-mapping.dmp

Download
memory/1388-54-0x0000000000280000-0x00000000002C8000-memory.dmp

Filesize
288KB

Download
memory/1388-57-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download
memory/1388-58-0x0000000074C70000-0x000000007521B000-memory.dmp

Filesize
5.7MB

Download
memory/1388-61-0x0000000074C70000-0x000000007521B000-memory.dmp

Filesize
5.7MB

Download