4894882b7b5fda0d48abcccb768d06e13b4f713ca92e8f136200bfb77b540399

Analysis

max time kernel
47s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 19:05

Target

4894882b7b5fda0d48abcccb768d06e13b4f713ca92e8f136200bfb77b540399.exe
Size

186KB
MD5

82fc505243383870fe98e45a40360de0
SHA1

36aefc4b384be2ccaa89ad21ccfec6219ea4ad44
SHA256

4894882b7b5fda0d48abcccb768d06e13b4f713ca92e8f136200bfb77b540399
SHA512

6b41cd2cce8c23be352d33229a2a48d2a85aee000dd48f3be87649f57eb1a5d7187eaaa22a069cfa0f38fdaaa3693397d4ef3223d99732d16a0de23e135d832a
SSDEEP

3072:ZqY/M/wLPHfLKGzH8YPE2l56Lp0Bk1zA+dgYFDa8hy1w9+fBn5J/julWDVALHvdY:8Y/M/wHKg8AE2l56Lp0Bk1zA+dgYFDai

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 1760	1544	4894882b7b5fda0d48abcccb768d06e13b4f713ca92e8f136200bfb77b540399.exe	26
PID 1544 wrote to memory of 1760	1544	4894882b7b5fda0d48abcccb768d06e13b4f713ca92e8f136200bfb77b540399.exe	26
PID 1544 wrote to memory of 1760	1544	4894882b7b5fda0d48abcccb768d06e13b4f713ca92e8f136200bfb77b540399.exe	26
PID 1544 wrote to memory of 1760	1544	4894882b7b5fda0d48abcccb768d06e13b4f713ca92e8f136200bfb77b540399.exe	26

C:\Users\Admin\AppData\Local\Temp\4894882b7b5fda0d48abcccb768d06e13b4f713ca92e8f136200bfb77b540399.exe
"C:\Users\Admin\AppData\Local\Temp\4894882b7b5fda0d48abcccb768d06e13b4f713ca92e8f136200bfb77b540399.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 472
  2⤵
  PID:1760

memory/1544-54-0x0000000075681000-0x0000000075683000-memory.dmp

Filesize
8KB

Download
memory/1544-57-0x0000000074530000-0x0000000074ADB000-memory.dmp

Filesize
5.7MB

Download
memory/1544-58-0x0000000074530000-0x0000000074ADB000-memory.dmp

Filesize
5.7MB

Download