084adf0b30c0d4fac04670c6fe0b392776f40808b26ff3c8eb8404d79e44bf9f

Analysis

max time kernel
62s
max time network
46s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:43

Target

084adf0b30c0d4fac04670c6fe0b392776f40808b26ff3c8eb8404d79e44bf9f.exe
Size

9KB
MD5

77796397c38b71549855834961c562c8
SHA1

a07de6041a11bdb671e9abcf300e95bfcfa6abbe
SHA256

084adf0b30c0d4fac04670c6fe0b392776f40808b26ff3c8eb8404d79e44bf9f
SHA512

3f88917084a411de5794a6989cd8cedf65f446c9de9ea899ffdf00f071c23b97d958ecf2b7e737dcab27376dbd78e1fbc63c90ee6d59af70cecdce109949e167
SSDEEP

192:/M9tlxDsEIWDK3C1V2nlYJL6LT+qjhRPngLr:/uleQaC1F2LT+qjhor

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

084adf0b30c0d4fac04670c6fe0b392776f40808b26ff3c8eb8404d79e44bf9f.exe

description	pid	process	target process
PID 1924 wrote to memory of 1048	1924	084adf0b30c0d4fac04670c6fe0b392776f40808b26ff3c8eb8404d79e44bf9f.exe	dw20.exe
PID 1924 wrote to memory of 1048	1924	084adf0b30c0d4fac04670c6fe0b392776f40808b26ff3c8eb8404d79e44bf9f.exe	dw20.exe
PID 1924 wrote to memory of 1048	1924	084adf0b30c0d4fac04670c6fe0b392776f40808b26ff3c8eb8404d79e44bf9f.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\084adf0b30c0d4fac04670c6fe0b392776f40808b26ff3c8eb8404d79e44bf9f.exe
"C:\Users\Admin\AppData\Local\Temp\084adf0b30c0d4fac04670c6fe0b392776f40808b26ff3c8eb8404d79e44bf9f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1924

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
dw20.exe -x -s 880
2⤵
PID:1048

memory/1048-55-0x0000000000000000-mapping.dmp

Download
memory/1048-56-0x000007FEFC381000-0x000007FEFC383000-memory.dmp

Filesize
8KB

Download
memory/1924-54-0x000007FEF4020000-0x000007FEF4A43000-memory.dmp

Filesize
10.1MB

Download