77879c4aeb523bf0da4fe2189aa0498310e5e848b7bfccb44b232415b3e744d0

Analysis

max time kernel
45s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 07:32

Target

77879c4aeb523bf0da4fe2189aa0498310e5e848b7bfccb44b232415b3e744d0.exe
Size

48KB
MD5

46a7a43d8162efbdd3171c69996c9b70
SHA1

61bed8d629617949d4221ba54fd4ab781b4ca213
SHA256

77879c4aeb523bf0da4fe2189aa0498310e5e848b7bfccb44b232415b3e744d0
SHA512

041982fc432a5ad8bd4b35d209cfbf416e6ef53fabcc1a0e2db5e1f1bd9421c8a018e4f643dca76b579afc30e67e07219585df39d84db8245562d2c4e9cfdd44
SSDEEP

1536:fepPeLweH3SiygeMeQeJi+TeOWmySEFnp/uZiaRJ1Yy5ooHzep8eH6uMK+XK++K8:5pLy+99

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 1928	1444	77879c4aeb523bf0da4fe2189aa0498310e5e848b7bfccb44b232415b3e744d0.exe	27
PID 1444 wrote to memory of 1928	1444	77879c4aeb523bf0da4fe2189aa0498310e5e848b7bfccb44b232415b3e744d0.exe	27
PID 1444 wrote to memory of 1928	1444	77879c4aeb523bf0da4fe2189aa0498310e5e848b7bfccb44b232415b3e744d0.exe	27
PID 1444 wrote to memory of 1928	1444	77879c4aeb523bf0da4fe2189aa0498310e5e848b7bfccb44b232415b3e744d0.exe	27

C:\Users\Admin\AppData\Local\Temp\77879c4aeb523bf0da4fe2189aa0498310e5e848b7bfccb44b232415b3e744d0.exe
"C:\Users\Admin\AppData\Local\Temp\77879c4aeb523bf0da4fe2189aa0498310e5e848b7bfccb44b232415b3e744d0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 396
  2⤵
  PID:1928

memory/1444-54-0x0000000075D71000-0x0000000075D73000-memory.dmp

Filesize
8KB

Download
memory/1444-57-0x0000000074850000-0x0000000074DFB000-memory.dmp

Filesize
5.7MB

Download
memory/1444-58-0x0000000074850000-0x0000000074DFB000-memory.dmp

Filesize
5.7MB

Download