2d06b14a3f732fd3da084ff3339d9c2b33ba28458162c44a9848fb9062e6e437

Analysis

max time kernel
31s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 13:57

Target

2d06b14a3f732fd3da084ff3339d9c2b33ba28458162c44a9848fb9062e6e437.exe
Size

165KB
MD5

5e7495e6b24964e1161226413bf7ebfa
SHA1

4a29991dd42642b79649f68b728186b533298089
SHA256

2d06b14a3f732fd3da084ff3339d9c2b33ba28458162c44a9848fb9062e6e437
SHA512

646e2d18632ca84fb38b87b0e57e8e37e156266f3f6c707122f3f3ed5f732125520373b86b4e9e55c1d8d0cac48985e6f6997b5715f3bb8bccfe33927ea3920b
SSDEEP

3072:uf0JzPw+9qBjIW3fc3/lyO73rAKfjAxGBA6mNwKY6UO:uf0JzPwAsjd3fc3gw3r1sx6EG6f

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 280	1972	2d06b14a3f732fd3da084ff3339d9c2b33ba28458162c44a9848fb9062e6e437.exe	28
PID 1972 wrote to memory of 280	1972	2d06b14a3f732fd3da084ff3339d9c2b33ba28458162c44a9848fb9062e6e437.exe	28
PID 1972 wrote to memory of 280	1972	2d06b14a3f732fd3da084ff3339d9c2b33ba28458162c44a9848fb9062e6e437.exe	28
PID 1972 wrote to memory of 280	1972	2d06b14a3f732fd3da084ff3339d9c2b33ba28458162c44a9848fb9062e6e437.exe	28

C:\Users\Admin\AppData\Local\Temp\2d06b14a3f732fd3da084ff3339d9c2b33ba28458162c44a9848fb9062e6e437.exe
"C:\Users\Admin\AppData\Local\Temp\2d06b14a3f732fd3da084ff3339d9c2b33ba28458162c44a9848fb9062e6e437.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 396
  2⤵
  PID:280

memory/1972-54-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download
memory/1972-57-0x0000000074240000-0x00000000747EB000-memory.dmp

Filesize
5.7MB

Download
memory/1972-58-0x0000000074240000-0x00000000747EB000-memory.dmp

Filesize
5.7MB

Download