6d9b8a740d033f4589d8235d79079e4070dab39c6dc4fcae9a65977cbee79b8f

Analysis

max time kernel
22s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 22:31

Target

6d9b8a740d033f4589d8235d79079e4070dab39c6dc4fcae9a65977cbee79b8f.exe
Size

33KB
MD5

850a28d0bce4c81f27615c03538a5250
SHA1

011237788a0b8aa6f1e1e52d5e8143927dcd7c98
SHA256

6d9b8a740d033f4589d8235d79079e4070dab39c6dc4fcae9a65977cbee79b8f
SHA512

f71d6fe5716c4d21113aed7e82398567fa05b9aa6ce45f8d9401c4b3ca91497cff6aa6a09ba9d828de0258e33268731f1d544f4a1c6a1e9395b95c6340171d33
SSDEEP

768:Z7mtplbVUeYPxDovjawhLc6VtYzJiplB6cA9Zx1x:kVc6HhLcg7cx1x

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 848	1948	6d9b8a740d033f4589d8235d79079e4070dab39c6dc4fcae9a65977cbee79b8f.exe	28
PID 1948 wrote to memory of 848	1948	6d9b8a740d033f4589d8235d79079e4070dab39c6dc4fcae9a65977cbee79b8f.exe	28
PID 1948 wrote to memory of 848	1948	6d9b8a740d033f4589d8235d79079e4070dab39c6dc4fcae9a65977cbee79b8f.exe	28
PID 1948 wrote to memory of 848	1948	6d9b8a740d033f4589d8235d79079e4070dab39c6dc4fcae9a65977cbee79b8f.exe	28

C:\Users\Admin\AppData\Local\Temp\6d9b8a740d033f4589d8235d79079e4070dab39c6dc4fcae9a65977cbee79b8f.exe
"C:\Users\Admin\AppData\Local\Temp\6d9b8a740d033f4589d8235d79079e4070dab39c6dc4fcae9a65977cbee79b8f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 900
  2⤵
  PID:848

memory/1948-54-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/1948-55-0x00000000743D0000-0x000000007497B000-memory.dmp

Filesize
5.7MB

Download
memory/1948-56-0x00000000743D0000-0x000000007497B000-memory.dmp

Filesize
5.7MB

Download