ba5785fd4ebd1261ad3fe6f957aacf765d608adb9893bfc8973de6470ac82edc

Analysis

max time kernel
37s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 15:48

Target

ba5785fd4ebd1261ad3fe6f957aacf765d608adb9893bfc8973de6470ac82edc.exe
Size

116KB
MD5

8261939ddea7a35ffe76fafe5b04f9e0
SHA1

15de1f583a0d323f3743cd6f5891dbf7f3b933a2
SHA256

ba5785fd4ebd1261ad3fe6f957aacf765d608adb9893bfc8973de6470ac82edc
SHA512

adf44d8e7e151d3a00b082ab77414759c96cc6d6a5498e960f88d4ab6fb27bb469c3a28596144468df9b44339b5ed43906786456e2e2002cccfe37da467ba65d
SSDEEP

3072:8ao0CCTzL18F0LX21GY4lXCRZAc7YSw3HwNc:NRDykm1GDRuLBC

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 1932	1168	ba5785fd4ebd1261ad3fe6f957aacf765d608adb9893bfc8973de6470ac82edc.exe	27
PID 1168 wrote to memory of 1932	1168	ba5785fd4ebd1261ad3fe6f957aacf765d608adb9893bfc8973de6470ac82edc.exe	27
PID 1168 wrote to memory of 1932	1168	ba5785fd4ebd1261ad3fe6f957aacf765d608adb9893bfc8973de6470ac82edc.exe	27
PID 1168 wrote to memory of 1932	1168	ba5785fd4ebd1261ad3fe6f957aacf765d608adb9893bfc8973de6470ac82edc.exe	27

C:\Users\Admin\AppData\Local\Temp\ba5785fd4ebd1261ad3fe6f957aacf765d608adb9893bfc8973de6470ac82edc.exe
"C:\Users\Admin\AppData\Local\Temp\ba5785fd4ebd1261ad3fe6f957aacf765d608adb9893bfc8973de6470ac82edc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 452
  2⤵
  PID:1932

memory/1168-54-0x0000000076401000-0x0000000076403000-memory.dmp

Filesize
8KB

Download
memory/1168-57-0x0000000074EA0000-0x000000007544B000-memory.dmp

Filesize
5.7MB

Download
memory/1168-58-0x0000000074EA0000-0x000000007544B000-memory.dmp

Filesize
5.7MB

Download