a616198d1c995ec383aea2993233229b88a66c3340b95d91127ff015701fd82c

Analysis

max time kernel
42s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 21:13

Target

a616198d1c995ec383aea2993233229b88a66c3340b95d91127ff015701fd82c.exe
Size

104KB
MD5

dc11b78170aa2184fd3f3996f4f4b016
SHA1

237d496df4d423ca576f5478664974e2fc722ed9
SHA256

a616198d1c995ec383aea2993233229b88a66c3340b95d91127ff015701fd82c
SHA512

c1415ed29aed303f619f525194c64d1160d01b93fe355381cdf5bc00be660248f2fd9900ac09e433f95debedb1df65449d8a9e0ead2be47c8e6cab7b56de7b87
SSDEEP

3072:wpRssoBc3560OLlYI9OTxZUkGWi+seZZM7Jiiyykp:uss76VLl7OvDDideyYz

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a616198d1c995ec383aea2993233229b88a66c3340b95d91127ff015701fd82c.exe

description	pid	process	target process
PID 1492 wrote to memory of 1152	1492	a616198d1c995ec383aea2993233229b88a66c3340b95d91127ff015701fd82c.exe	dw20.exe
PID 1492 wrote to memory of 1152	1492	a616198d1c995ec383aea2993233229b88a66c3340b95d91127ff015701fd82c.exe	dw20.exe
PID 1492 wrote to memory of 1152	1492	a616198d1c995ec383aea2993233229b88a66c3340b95d91127ff015701fd82c.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\a616198d1c995ec383aea2993233229b88a66c3340b95d91127ff015701fd82c.exe
"C:\Users\Admin\AppData\Local\Temp\a616198d1c995ec383aea2993233229b88a66c3340b95d91127ff015701fd82c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1492

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
dw20.exe -x -s 384
2⤵
PID:1152

memory/1152-57-0x0000000000000000-mapping.dmp

Download
memory/1152-58-0x000007FEFC5A1000-0x000007FEFC5A3000-memory.dmp

Filesize
8KB

Download
memory/1492-54-0x000007FEF49D0000-0x000007FEF53F3000-memory.dmp

Filesize
10.1MB

Download
memory/1492-55-0x000007FEF4390000-0x000007FEF4850000-memory.dmp

Filesize
4.8MB

Download
memory/1492-56-0x000007FEF2C50000-0x000007FEF3CE6000-memory.dmp

Filesize
16.6MB

Download