70de125193dfcc9f217b549d6eeb087cb0df3743a44f0e80152a6ee74651d5fc

Analysis

max time kernel
40s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 03:08

Target

70de125193dfcc9f217b549d6eeb087cb0df3743a44f0e80152a6ee74651d5fc.exe
Size

1.3MB
MD5

a299daf80936e4b295e8f5908a2e6aeb
SHA1

3aa75359effbe50de189e9d564409500d6b89e83
SHA256

70de125193dfcc9f217b549d6eeb087cb0df3743a44f0e80152a6ee74651d5fc
SHA512

08b54460d9a3e6c56a3c4d1597afe51ae518e60dbc1df28c1625dce2bf7ebcd4d5b7084b504f91bbfa98b2e1a72b947648d9a5021f736b8feb94e719b64846a9
SSDEEP

24576:fELQpYqc3pW0P6Be/hcowze9bEUzx9EP:fELQuFzPqe/Kow4bE+E

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 2020	1044	70de125193dfcc9f217b549d6eeb087cb0df3743a44f0e80152a6ee74651d5fc.exe	28
PID 1044 wrote to memory of 2020	1044	70de125193dfcc9f217b549d6eeb087cb0df3743a44f0e80152a6ee74651d5fc.exe	28
PID 1044 wrote to memory of 2020	1044	70de125193dfcc9f217b549d6eeb087cb0df3743a44f0e80152a6ee74651d5fc.exe	28
PID 1044 wrote to memory of 2020	1044	70de125193dfcc9f217b549d6eeb087cb0df3743a44f0e80152a6ee74651d5fc.exe	28

C:\Users\Admin\AppData\Local\Temp\70de125193dfcc9f217b549d6eeb087cb0df3743a44f0e80152a6ee74651d5fc.exe
"C:\Users\Admin\AppData\Local\Temp\70de125193dfcc9f217b549d6eeb087cb0df3743a44f0e80152a6ee74651d5fc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 432
  2⤵
  PID:2020

memory/1044-54-0x00000000756A1000-0x00000000756A3000-memory.dmp

Filesize
8KB

Download
memory/1044-55-0x00000000748C0000-0x0000000074E6B000-memory.dmp

Filesize
5.7MB

Download
memory/1044-58-0x00000000748C0000-0x0000000074E6B000-memory.dmp

Filesize
5.7MB

Download