8256e475a59557155e35c036a4d1cb43537ac1e33a7752fae7b3e812787c93c1

Analysis

max time kernel
40s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:47

Target

8256e475a59557155e35c036a4d1cb43537ac1e33a7752fae7b3e812787c93c1.exe
Size

253KB
MD5

ba3cdc8e7b55da3e792617d6d43b0dda
SHA1

b5cefad46eb04e5388e5cfb78e382a59f8846a9b
SHA256

8256e475a59557155e35c036a4d1cb43537ac1e33a7752fae7b3e812787c93c1
SHA512

c93fd29676cecc456cbd155ea1969fcc96dd256ace9667903e0756b1133b1bb9dc36cfe2feb668aa27fe4691b5904ed39e0eff574e26af7d3c99d3033c9b8d79
SSDEEP

3072:/ySycOlyR/IQMPRgq71ppM48XLuCHWH/k1nLBnAfuna471ppM48XS2t:auIQMPx/bwuC2HgBAfuna4x/bH2

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

8256e475a59557155e35c036a4d1cb43537ac1e33a7752fae7b3e812787c93c1.exe

description	pid	process	target process
PID 1096 wrote to memory of 1744	1096	8256e475a59557155e35c036a4d1cb43537ac1e33a7752fae7b3e812787c93c1.exe	dw20.exe
PID 1096 wrote to memory of 1744	1096	8256e475a59557155e35c036a4d1cb43537ac1e33a7752fae7b3e812787c93c1.exe	dw20.exe
PID 1096 wrote to memory of 1744	1096	8256e475a59557155e35c036a4d1cb43537ac1e33a7752fae7b3e812787c93c1.exe	dw20.exe
PID 1096 wrote to memory of 1744	1096	8256e475a59557155e35c036a4d1cb43537ac1e33a7752fae7b3e812787c93c1.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\8256e475a59557155e35c036a4d1cb43537ac1e33a7752fae7b3e812787c93c1.exe
"C:\Users\Admin\AppData\Local\Temp\8256e475a59557155e35c036a4d1cb43537ac1e33a7752fae7b3e812787c93c1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1096

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 916
2⤵
PID:1744

memory/1096-54-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download
memory/1096-55-0x0000000074C70000-0x000000007521B000-memory.dmp

Filesize
5.7MB

Download
memory/1096-58-0x0000000074C70000-0x000000007521B000-memory.dmp

Filesize
5.7MB

Download
memory/1744-56-0x0000000000000000-mapping.dmp

Download