ea6dd47a47719361da8c63b6b27aa9ed07b2f6cf8c3526d66d8bc5d943c37d54

Analysis

max time kernel
100s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 22:57

Target

uLrcEditor211/Plugin/MediaRenamer.exe
Size

215KB
MD5

70d294b5953209824797f966d7861943
SHA1

2c7ba6eac42a215e38d2298f4ba5e69c1f029a4e
SHA256

4efec713449f6560f56b760cf1263dd98d7db268d18dd675d333e43bb46cd9a9
SHA512

3b2b0ca6f358c1ccdd97a1088c5e19178f731cd8a16e2aad3c5c800602d16226a3cd63bc08446aa151c0e230ffb7c40a859753634fbf5d3917781a898007de4d
SSDEEP

768:Puf2RSJZeGZXfLcge9GdAtSx67RtNUHEpTgaPi78Mz0Q/W2vz1GnfLcge9GdAtSg:QnfLHvEEp0Q/W2vz1GnfLHvE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 768	948	MediaRenamer.exe	28
PID 948 wrote to memory of 768	948	MediaRenamer.exe	28
PID 948 wrote to memory of 768	948	MediaRenamer.exe	28

C:\Users\Admin\AppData\Local\Temp\uLrcEditor211\Plugin\MediaRenamer.exe
"C:\Users\Admin\AppData\Local\Temp\uLrcEditor211\Plugin\MediaRenamer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 636
  2⤵
  PID:768

memory/768-57-0x000007FEFBD91000-0x000007FEFBD93000-memory.dmp

Filesize
8KB

Download
memory/948-54-0x000007FEF3AE0000-0x000007FEF4503000-memory.dmp

Filesize
10.1MB

Download
memory/948-55-0x000007FEF2460000-0x000007FEF34F6000-memory.dmp

Filesize
16.6MB

Download