b0352074c6f0556acf2215aa41e485085b1c7561f645f1d314a570acd31ccc1b

Analysis

max time kernel
33s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 11:47

Target

2014-12-22 #32/1952f6f1225202929d7be4217473e7ce.exe
Size

139KB
MD5

1952f6f1225202929d7be4217473e7ce
SHA1

5b3f201727e5942164c808d2afa35224fd9af939
SHA256

9ed4b6fda9fe81a90363674243da3a172c381e3af83f2985d1763d171e7a9467
SHA512

fd43b89bff8aa2b266a7758f0bc44588978ba42757535af2a58c4def08fea001590cb374c406486daebc8cb8599e76b988be1cd1bf189da8de4046a5256da421
SSDEEP

3072:/wPmh/CRyZ5aawYsA/mgLPLQ5HBLiu81+Owv6A9t1h:/wVUD1samgLPLq81+59B

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1952f6f1225202929d7be4217473e7ce.exe

description	pid	process	target process
PID 916 wrote to memory of 768	916	1952f6f1225202929d7be4217473e7ce.exe	dw20.exe
PID 916 wrote to memory of 768	916	1952f6f1225202929d7be4217473e7ce.exe	dw20.exe
PID 916 wrote to memory of 768	916	1952f6f1225202929d7be4217473e7ce.exe	dw20.exe
PID 916 wrote to memory of 768	916	1952f6f1225202929d7be4217473e7ce.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\2014-12-22 #32\1952f6f1225202929d7be4217473e7ce.exe
"C:\Users\Admin\AppData\Local\Temp\2014-12-22 #32\1952f6f1225202929d7be4217473e7ce.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 456
  2⤵
  PID:768

memory/768-55-0x0000000000000000-mapping.dmp

Download
memory/916-54-0x0000000076091000-0x0000000076093000-memory.dmp

Filesize
8KB

Download
memory/916-57-0x00000000744B0000-0x0000000074A5B000-memory.dmp

Filesize
5.7MB

Download
memory/916-58-0x00000000744B0000-0x0000000074A5B000-memory.dmp

Filesize
5.7MB

Download