1b8fbf5b6e5c980a7ef15a63241a63c11c638ce091284e7375564e4480beb0b5

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 10:07

Target

1b8fbf5b6e5c980a7ef15a63241a63c11c638ce091284e7375564e4480beb0b5.exe
Size

152KB
MD5

09b9054aef3fc60f2e3c1707a3e3df40
SHA1

27142f670494c6fb32c58ce73e93e704ba2c4b3d
SHA256

1b8fbf5b6e5c980a7ef15a63241a63c11c638ce091284e7375564e4480beb0b5
SHA512

5cf1926998b4d13cbc0b30ae17bea261925cf615ac034768cb1c9bb1a641a9338e7d184644d20e1299a82d61dd6dcbc3bad261e8d855c87d29ed2f01533dc8c2
SSDEEP

3072:eoi0GrJRoruVOlM4Zudgv/zEF96+BOXLvDjTwWiwE+HD8OZ5:tiTkVGO/zEHS7vPTavGN7

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 1948	768	1b8fbf5b6e5c980a7ef15a63241a63c11c638ce091284e7375564e4480beb0b5.exe	27
PID 768 wrote to memory of 1948	768	1b8fbf5b6e5c980a7ef15a63241a63c11c638ce091284e7375564e4480beb0b5.exe	27
PID 768 wrote to memory of 1948	768	1b8fbf5b6e5c980a7ef15a63241a63c11c638ce091284e7375564e4480beb0b5.exe	27
PID 768 wrote to memory of 1948	768	1b8fbf5b6e5c980a7ef15a63241a63c11c638ce091284e7375564e4480beb0b5.exe	27

C:\Users\Admin\AppData\Local\Temp\1b8fbf5b6e5c980a7ef15a63241a63c11c638ce091284e7375564e4480beb0b5.exe
"C:\Users\Admin\AppData\Local\Temp\1b8fbf5b6e5c980a7ef15a63241a63c11c638ce091284e7375564e4480beb0b5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:768
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 420
  2⤵
  PID:1948

memory/768-54-0x0000000076871000-0x0000000076873000-memory.dmp

Filesize
8KB

Download
memory/768-57-0x0000000074EE0000-0x000000007548B000-memory.dmp

Filesize
5.7MB

Download
memory/768-58-0x0000000074EE0000-0x000000007548B000-memory.dmp

Filesize
5.7MB

Download