570dfb40480c399fd3c4fdd583eed0434c56306a423abbf9ccf56f1aacc8af7c

Analysis

max time kernel
20s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 17:09

Target

570dfb40480c399fd3c4fdd583eed0434c56306a423abbf9ccf56f1aacc8af7c.exe
Size

156KB
MD5

8f3b4ef91ab479ea77718ef3f8eb9872
SHA1

bc25e13503165000f710febaebe2d4c6e66c78ef
SHA256

570dfb40480c399fd3c4fdd583eed0434c56306a423abbf9ccf56f1aacc8af7c
SHA512

af9d6cb4a9d90b7f9df713215d61ca55071164eb8afa79363007317bae0b8ffa6ea4179c737579d5731c05f49010b223c58ef8e30b394ce5875f840e25928133
SSDEEP

3072:7MUzI+9CLfb75NUmfYQp/IRLsqd1pIecTH:7MWIACLT7wgYDs4pG

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

570dfb40480c399fd3c4fdd583eed0434c56306a423abbf9ccf56f1aacc8af7c.exe

description	pid	process	target process
PID 1784 wrote to memory of 1992	1784	570dfb40480c399fd3c4fdd583eed0434c56306a423abbf9ccf56f1aacc8af7c.exe	dw20.exe
PID 1784 wrote to memory of 1992	1784	570dfb40480c399fd3c4fdd583eed0434c56306a423abbf9ccf56f1aacc8af7c.exe	dw20.exe
PID 1784 wrote to memory of 1992	1784	570dfb40480c399fd3c4fdd583eed0434c56306a423abbf9ccf56f1aacc8af7c.exe	dw20.exe
PID 1784 wrote to memory of 1992	1784	570dfb40480c399fd3c4fdd583eed0434c56306a423abbf9ccf56f1aacc8af7c.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\570dfb40480c399fd3c4fdd583eed0434c56306a423abbf9ccf56f1aacc8af7c.exe
"C:\Users\Admin\AppData\Local\Temp\570dfb40480c399fd3c4fdd583eed0434c56306a423abbf9ccf56f1aacc8af7c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1784

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 400
2⤵
PID:1992

memory/1784-54-0x00000000764D1000-0x00000000764D3000-memory.dmp

Filesize
8KB

Download
memory/1784-57-0x0000000074590000-0x0000000074B3B000-memory.dmp

Filesize
5.7MB

Download
memory/1784-58-0x0000000074590000-0x0000000074B3B000-memory.dmp

Filesize
5.7MB

Download
memory/1992-55-0x0000000000000000-mapping.dmp

Download