469b35205b97c6fd49a225953fb12ce8e0b4eca5c2fd56289d5a1830c63d11a1

Analysis

max time kernel
42s
max time network
88s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 15:39

Target

469b35205b97c6fd49a225953fb12ce8e0b4eca5c2fd56289d5a1830c63d11a1.exe
Size

113KB
MD5

1fda3fc2c9ddc9a1e0d46ab008fb4b19
SHA1

f68bd28a214e3b8ffeb25eaa626714f7aa0260db
SHA256

469b35205b97c6fd49a225953fb12ce8e0b4eca5c2fd56289d5a1830c63d11a1
SHA512

a38adf0c54ddc7db4aba7e8662a5e3b414606e1e77b64100e9869cb19718731530bfc4f97fe675c37eb2847347666328652c8598cea51b573507de4a696abcea
SSDEEP

1536:3Tz51Urjlb3fMsXTmj1WeQk6e33ceKeWyJgzgnCb4odfPorv4pP2yoH52:DzelTMs8JQ7vgnCcoxgrWPAHk

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

469b35205b97c6fd49a225953fb12ce8e0b4eca5c2fd56289d5a1830c63d11a1.exe

description	pid	process	target process
PID 800 wrote to memory of 1968	800	469b35205b97c6fd49a225953fb12ce8e0b4eca5c2fd56289d5a1830c63d11a1.exe	dw20.exe
PID 800 wrote to memory of 1968	800	469b35205b97c6fd49a225953fb12ce8e0b4eca5c2fd56289d5a1830c63d11a1.exe	dw20.exe
PID 800 wrote to memory of 1968	800	469b35205b97c6fd49a225953fb12ce8e0b4eca5c2fd56289d5a1830c63d11a1.exe	dw20.exe
PID 800 wrote to memory of 1968	800	469b35205b97c6fd49a225953fb12ce8e0b4eca5c2fd56289d5a1830c63d11a1.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\469b35205b97c6fd49a225953fb12ce8e0b4eca5c2fd56289d5a1830c63d11a1.exe
"C:\Users\Admin\AppData\Local\Temp\469b35205b97c6fd49a225953fb12ce8e0b4eca5c2fd56289d5a1830c63d11a1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:800

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 424
2⤵
PID:1968

memory/800-54-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download
memory/800-57-0x00000000745A0000-0x0000000074B4B000-memory.dmp

Filesize
5.7MB

Download
memory/800-58-0x00000000745A0000-0x0000000074B4B000-memory.dmp

Filesize
5.7MB

Download
memory/1968-55-0x0000000000000000-mapping.dmp

Download