c134de43ee0c15dc13b007dc4d530907e634b48521be8aa28f7384a06b973747

Analysis

max time kernel
44s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:43

Target

c134de43ee0c15dc13b007dc4d530907e634b48521be8aa28f7384a06b973747.exe
Size

9KB
MD5

e7155e4ff13359e2a453406e96420ff3
SHA1

0882449c9d72ebbb8f3a93e084f56c5456973207
SHA256

c134de43ee0c15dc13b007dc4d530907e634b48521be8aa28f7384a06b973747
SHA512

ce9faab3a8646675003414c8da290f502527b8ec47c8d2f9e394224f394886a18946f6866a4a842fedf5026f028c84af2c10c63228051e8f92013c38ed019daa
SSDEEP

192:pktltDsEIWDK3C1V2nlYJL6LT+qjlRpngLn:pilaQaC1F2LT+qjlen

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c134de43ee0c15dc13b007dc4d530907e634b48521be8aa28f7384a06b973747.exe

description	pid	process	target process
PID 1788 wrote to memory of 1092	1788	c134de43ee0c15dc13b007dc4d530907e634b48521be8aa28f7384a06b973747.exe	dw20.exe
PID 1788 wrote to memory of 1092	1788	c134de43ee0c15dc13b007dc4d530907e634b48521be8aa28f7384a06b973747.exe	dw20.exe
PID 1788 wrote to memory of 1092	1788	c134de43ee0c15dc13b007dc4d530907e634b48521be8aa28f7384a06b973747.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\c134de43ee0c15dc13b007dc4d530907e634b48521be8aa28f7384a06b973747.exe
"C:\Users\Admin\AppData\Local\Temp\c134de43ee0c15dc13b007dc4d530907e634b48521be8aa28f7384a06b973747.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1788

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
dw20.exe -x -s 876
2⤵
PID:1092

memory/1092-55-0x0000000000000000-mapping.dmp

Download
memory/1092-56-0x000007FEFBF41000-0x000007FEFBF43000-memory.dmp

Filesize
8KB

Download
memory/1788-54-0x000007FEF3BC0000-0x000007FEF45E3000-memory.dmp

Filesize
10.1MB

Download