358e5bc194d44804af5ad190433675069ebe55fc499d617eeb3564c4753ed943

Analysis

max time kernel
39s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 17:14

Target

0x000b000000012326-58.exe
Size

209KB
MD5

ec47cb00fe954c0e17efc2b31914f00c
SHA1

3225eb91a5583deb4d1dfd493d53dfc39b3a583d
SHA256

358e5bc194d44804af5ad190433675069ebe55fc499d617eeb3564c4753ed943
SHA512

24f6cad23ddd6f06967a868f66a9cb2a80116e99c37fe767c36b16419bc311ff3df44fadc3249102903c207f16619c3f7741779c1790e708b22af13bd6f2952d
SSDEEP

3072:MyV2PuG8Qglsmfi5JyB2CdG8FUqbnwm9Jk0ySoEXJffxXdOHzkY62r1hQBk4:1Vk8aMRHUqbnwm7HzoenLOT7jQ

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1016	2020	0x000b000000012326-58.exe	26
PID 2020 wrote to memory of 1016	2020	0x000b000000012326-58.exe	26
PID 2020 wrote to memory of 1016	2020	0x000b000000012326-58.exe	26
PID 2020 wrote to memory of 1016	2020	0x000b000000012326-58.exe	26

C:\Users\Admin\AppData\Local\Temp\0x000b000000012326-58.exe
"C:\Users\Admin\AppData\Local\Temp\0x000b000000012326-58.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 424
  2⤵
  PID:1016

memory/2020-54-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download
memory/2020-55-0x00000000741F0000-0x000000007479B000-memory.dmp

Filesize
5.7MB

Download
memory/2020-58-0x00000000741F0000-0x000000007479B000-memory.dmp

Filesize
5.7MB

Download