1ed05d14f0b010e4cc91d2f3a2742cb45d0ce7a9abbb81d9dde1fec4c9e418f2

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 23:48

Target

1ed05d14f0b010e4cc91d2f3a2742cb45d0ce7a9abbb81d9dde1fec4c9e418f2.exe
Size

1.4MB
MD5

920d27ec986fdb9a4c2ae97a324e88a0
SHA1

adefcb23487dca3c2af5226669a54a4a7aa17e0d
SHA256

1ed05d14f0b010e4cc91d2f3a2742cb45d0ce7a9abbb81d9dde1fec4c9e418f2
SHA512

b0b7192d4189fc03795749094f8df678728369face74b41b387ac857cd9bdc1a03879a41b76a4827205601cf900cfe471a21f3e31e8240bb4b6d9763728afed9
SSDEEP

24576:dELQpYXc3pW0P6BehbcD9QgGXUS0RnL0XA54QQ:dELQuGzPqeaD64Xs

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 1788	1184	1ed05d14f0b010e4cc91d2f3a2742cb45d0ce7a9abbb81d9dde1fec4c9e418f2.exe	27
PID 1184 wrote to memory of 1788	1184	1ed05d14f0b010e4cc91d2f3a2742cb45d0ce7a9abbb81d9dde1fec4c9e418f2.exe	27
PID 1184 wrote to memory of 1788	1184	1ed05d14f0b010e4cc91d2f3a2742cb45d0ce7a9abbb81d9dde1fec4c9e418f2.exe	27
PID 1184 wrote to memory of 1788	1184	1ed05d14f0b010e4cc91d2f3a2742cb45d0ce7a9abbb81d9dde1fec4c9e418f2.exe	27

C:\Users\Admin\AppData\Local\Temp\1ed05d14f0b010e4cc91d2f3a2742cb45d0ce7a9abbb81d9dde1fec4c9e418f2.exe
"C:\Users\Admin\AppData\Local\Temp\1ed05d14f0b010e4cc91d2f3a2742cb45d0ce7a9abbb81d9dde1fec4c9e418f2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 432
  2⤵
  PID:1788

memory/1184-54-0x0000000074BB1000-0x0000000074BB3000-memory.dmp

Filesize
8KB

Download
memory/1184-55-0x0000000074110000-0x00000000746BB000-memory.dmp

Filesize
5.7MB

Download
memory/1184-58-0x0000000074110000-0x00000000746BB000-memory.dmp

Filesize
5.7MB

Download