0099966f1f67d2058536ef42759cfb01d6f548a89b3a6f63e15bdee4752a2b58

Analysis

max time kernel
41s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 04:41

Target

0099966f1f67d2058536ef42759cfb01d6f548a89b3a6f63e15bdee4752a2b58.exe
Size

603KB
MD5

d575d873c17fc4351d172c97079e3213
SHA1

091a05aaf54e1321d51e14dd035e7dcfe20a0fa2
SHA256

0099966f1f67d2058536ef42759cfb01d6f548a89b3a6f63e15bdee4752a2b58
SHA512

037afc8de8fb5ce151c9e473d222f3448ee2b1520ddc617573a931f154f8f3e2afe3fe0b86de68ca79b1dcb078a4b395555da99dbcef5caa6d50628fcd0a594a
SSDEEP

12288:6BZGqmFj0Fx2ypXK16xgrE1WKS5sW5BrMBgkS9UOIK/:bq/bTM0gGSpdMCkSuOIK/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 1884	1960	0099966f1f67d2058536ef42759cfb01d6f548a89b3a6f63e15bdee4752a2b58.exe	28
PID 1960 wrote to memory of 1884	1960	0099966f1f67d2058536ef42759cfb01d6f548a89b3a6f63e15bdee4752a2b58.exe	28
PID 1960 wrote to memory of 1884	1960	0099966f1f67d2058536ef42759cfb01d6f548a89b3a6f63e15bdee4752a2b58.exe	28

C:\Users\Admin\AppData\Local\Temp\0099966f1f67d2058536ef42759cfb01d6f548a89b3a6f63e15bdee4752a2b58.exe
"C:\Users\Admin\AppData\Local\Temp\0099966f1f67d2058536ef42759cfb01d6f548a89b3a6f63e15bdee4752a2b58.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 456
  2⤵
  PID:1884

memory/1884-58-0x000007FEFB6D1000-0x000007FEFB6D3000-memory.dmp

Filesize
8KB

Download
memory/1960-54-0x000007FEF3E90000-0x000007FEF48B3000-memory.dmp

Filesize
10.1MB

Download
memory/1960-55-0x000007FEF39D0000-0x000007FEF3E90000-memory.dmp

Filesize
4.8MB

Download
memory/1960-56-0x000007FEF26F0000-0x000007FEF3786000-memory.dmp

Filesize
16.6MB

Download