ee83df31237f1092b18c021a52b59baf96d3930c056a4e3aa772f0096d532c68

Analysis

max time kernel
246s
max time network
334s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 19:45

Target

ee83df31237f1092b18c021a52b59baf96d3930c056a4e3aa772f0096d532c68.exe
Size

200KB
MD5

e6f6947549141952e769bdaeacd03bcb
SHA1

7294b603de879b15a38987e4d91f3a4fe69d3069
SHA256

ee83df31237f1092b18c021a52b59baf96d3930c056a4e3aa772f0096d532c68
SHA512

7b24dd622960c13f45880eb05d18e028658117520b49b1b155713f07ff253eda389c2e99843b1ae3688eafe0eabbe12ea9201386b850f4a1207931c9c6ee87ed
SSDEEP

6144:3pJBRlktIcWn2GBF7HrBgnNSWBMroAFyAQfkCzDpx88N9i3PycX+Qc4C:3p4GcWn2GasYVnm6pv4

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 1120	1128	ee83df31237f1092b18c021a52b59baf96d3930c056a4e3aa772f0096d532c68.exe	28
PID 1128 wrote to memory of 1120	1128	ee83df31237f1092b18c021a52b59baf96d3930c056a4e3aa772f0096d532c68.exe	28
PID 1128 wrote to memory of 1120	1128	ee83df31237f1092b18c021a52b59baf96d3930c056a4e3aa772f0096d532c68.exe	28
PID 1128 wrote to memory of 1120	1128	ee83df31237f1092b18c021a52b59baf96d3930c056a4e3aa772f0096d532c68.exe	28

C:\Users\Admin\AppData\Local\Temp\ee83df31237f1092b18c021a52b59baf96d3930c056a4e3aa772f0096d532c68.exe
"C:\Users\Admin\AppData\Local\Temp\ee83df31237f1092b18c021a52b59baf96d3930c056a4e3aa772f0096d532c68.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 420
  2⤵
  PID:1120

memory/1128-54-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

Filesize
8KB

Download
memory/1128-57-0x0000000074E40000-0x00000000753EB000-memory.dmp

Filesize
5.7MB

Download