3a0940466bda779108453558e3fcd3a85078fc870dfd39d792292b6a2866c006

Analysis

max time kernel
40s
max time network
116s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 19:42

Target

61ab40de59e48a1c60446f3dbe1a5f35.exe
Size

586KB
MD5

61ab40de59e48a1c60446f3dbe1a5f35
SHA1

e347ffad5f0c7839703110cb4df90a7eaadba6d0
SHA256

3a0940466bda779108453558e3fcd3a85078fc870dfd39d792292b6a2866c006
SHA512

3e31a8cbd02a84b007ded2783e68b79cba8257a241d1a3abb88bc3c1d6dbf727d8a29c65f2abc9b3bbd176bb8e8bf64da8f45d013ad6c0ebcd67dd7aba9148be
SSDEEP

6144:8REZ36IdRGu4pxtCAXmqQmGbaY/IcH9N/HCoFpK:rZ3ndRaQmmyGbaY/IcH9N/HCo

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 936	1480	61ab40de59e48a1c60446f3dbe1a5f35.exe	27
PID 1480 wrote to memory of 936	1480	61ab40de59e48a1c60446f3dbe1a5f35.exe	27
PID 1480 wrote to memory of 936	1480	61ab40de59e48a1c60446f3dbe1a5f35.exe	27

C:\Users\Admin\AppData\Local\Temp\61ab40de59e48a1c60446f3dbe1a5f35.exe
"C:\Users\Admin\AppData\Local\Temp\61ab40de59e48a1c60446f3dbe1a5f35.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 972
  2⤵
  PID:936

memory/936-56-0x000007FEFB991000-0x000007FEFB993000-memory.dmp

Filesize
8KB

Download
memory/1480-54-0x000007FEF3610000-0x000007FEF4033000-memory.dmp

Filesize
10.1MB

Download