e93fc0b1c437718bb33fb6b69739739f33d74697bfb085ef106b53b89b77393b

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 07:02

Target

e93fc0b1c437718bb33fb6b69739739f33d74697bfb085ef106b53b89b77393b.exe
Size

261KB
MD5

1249680fd2089331cfa981c7f5986920
SHA1

3b1fe03a52aa894f0d42836a85d8b97306d845c6
SHA256

e93fc0b1c437718bb33fb6b69739739f33d74697bfb085ef106b53b89b77393b
SHA512

a5335fd63c1983b1a252c11e2a7483c10da5966596b831861275845a387b69d520811ad05f7e11cb35b6dbae3e601682e9f5e0763fd1e0ad6f045fa3867c7f35
SSDEEP

3072:aLQiY+kprvhQdfL5HnkoWz9Z2ZBz50MRtjZUJwvLRJ2U2A:uyv5vIlnqz9Z2Zt5xbSy2U2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 2012	1048	e93fc0b1c437718bb33fb6b69739739f33d74697bfb085ef106b53b89b77393b.exe	27
PID 1048 wrote to memory of 2012	1048	e93fc0b1c437718bb33fb6b69739739f33d74697bfb085ef106b53b89b77393b.exe	27
PID 1048 wrote to memory of 2012	1048	e93fc0b1c437718bb33fb6b69739739f33d74697bfb085ef106b53b89b77393b.exe	27

C:\Users\Admin\AppData\Local\Temp\e93fc0b1c437718bb33fb6b69739739f33d74697bfb085ef106b53b89b77393b.exe
"C:\Users\Admin\AppData\Local\Temp\e93fc0b1c437718bb33fb6b69739739f33d74697bfb085ef106b53b89b77393b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 404
  2⤵
  PID:2012

memory/1048-54-0x000007FEF39C0000-0x000007FEF43E3000-memory.dmp

Filesize
10.1MB

Download
memory/1048-55-0x000007FEEDD50000-0x000007FEEEDE6000-memory.dmp

Filesize
16.6MB

Download
memory/2012-57-0x000007FEFBEE1000-0x000007FEFBEE3000-memory.dmp

Filesize
8KB

Download