13b88dd259efca4315663eac487ee2d2151f5f9152e34ac98c5b68d2cdfb4a9d

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 23:15

Target

13b88dd259efca4315663eac487ee2d2151f5f9152e34ac98c5b68d2cdfb4a9d.exe
Size

71KB
MD5

84b5630b9da0d76c3a92986f99491cf0
SHA1

a1828e4e1dae71f3d60ba8eb740943f258cc09ba
SHA256

13b88dd259efca4315663eac487ee2d2151f5f9152e34ac98c5b68d2cdfb4a9d
SHA512

d3cb093b827cc81bca0c55bb44156cb9bcabe46d0cf14f5240bff6e579163dc4058d5041ad4db53e34e3dc4c046e68a4280358a587f3f7a9a8212a1989a9f2b5
SSDEEP

768:8YAWfu24FG4oThGCZa5fdzOc61hi4ICcsbVPN9Kmq6u0K3Q9LN99v2rguE1u:vArPZUtco8sH9Kmq6uZqh/v2rguIu

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1400	2000	13b88dd259efca4315663eac487ee2d2151f5f9152e34ac98c5b68d2cdfb4a9d.exe	28
PID 2000 wrote to memory of 1400	2000	13b88dd259efca4315663eac487ee2d2151f5f9152e34ac98c5b68d2cdfb4a9d.exe	28
PID 2000 wrote to memory of 1400	2000	13b88dd259efca4315663eac487ee2d2151f5f9152e34ac98c5b68d2cdfb4a9d.exe	28
PID 2000 wrote to memory of 1400	2000	13b88dd259efca4315663eac487ee2d2151f5f9152e34ac98c5b68d2cdfb4a9d.exe	28

C:\Users\Admin\AppData\Local\Temp\13b88dd259efca4315663eac487ee2d2151f5f9152e34ac98c5b68d2cdfb4a9d.exe
"C:\Users\Admin\AppData\Local\Temp\13b88dd259efca4315663eac487ee2d2151f5f9152e34ac98c5b68d2cdfb4a9d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 396
  2⤵
  PID:1400

memory/1400-55-0x0000000000000000-mapping.dmp

Download
memory/2000-54-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/2000-57-0x00000000743D0000-0x000000007497B000-memory.dmp

Filesize
5.7MB

Download
memory/2000-58-0x00000000743D0000-0x000000007497B000-memory.dmp

Filesize
5.7MB

Download