31593f1730a2e44471ed9c5d2bf87438399349f49cf70d0cfb8813cfedfd2c0d

Analysis

max time kernel
19s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 09:19

Target

31593f1730a2e44471ed9c5d2bf87438399349f49cf70d0cfb8813cfedfd2c0d.exe
Size

33KB
MD5

26c13d5b2a3632f728a647f95b61a6d0
SHA1

056646525d1e134775c77b35a95a0e0c00e45108
SHA256

31593f1730a2e44471ed9c5d2bf87438399349f49cf70d0cfb8813cfedfd2c0d
SHA512

7c5bbfecdbd9824ecc79abefc81cd17178be765ed0433fa439800df07ee9a9c171b7a8f36a4b53cb03511500eba4bdcc048831877c73853bce6480d4947b3194
SSDEEP

768:ZzO5On5hxbuUrgfhiqCwSSp6Kr8r3PE7Fp2Sg6crq:HjxbuogfewSSp6i8TPUFp2X6cr

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 2044	852	31593f1730a2e44471ed9c5d2bf87438399349f49cf70d0cfb8813cfedfd2c0d.exe	27
PID 852 wrote to memory of 2044	852	31593f1730a2e44471ed9c5d2bf87438399349f49cf70d0cfb8813cfedfd2c0d.exe	27
PID 852 wrote to memory of 2044	852	31593f1730a2e44471ed9c5d2bf87438399349f49cf70d0cfb8813cfedfd2c0d.exe	27
PID 852 wrote to memory of 2044	852	31593f1730a2e44471ed9c5d2bf87438399349f49cf70d0cfb8813cfedfd2c0d.exe	27

C:\Users\Admin\AppData\Local\Temp\31593f1730a2e44471ed9c5d2bf87438399349f49cf70d0cfb8813cfedfd2c0d.exe
"C:\Users\Admin\AppData\Local\Temp\31593f1730a2e44471ed9c5d2bf87438399349f49cf70d0cfb8813cfedfd2c0d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:852
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 424
  2⤵
  PID:2044

memory/852-54-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

Filesize
8KB

Download
memory/852-57-0x0000000074DC0000-0x000000007536B000-memory.dmp

Filesize
5.7MB

Download
memory/852-58-0x0000000074DC0000-0x000000007536B000-memory.dmp

Filesize
5.7MB

Download
memory/2044-55-0x0000000000000000-mapping.dmp

Download