790c8d30d78be3df96b1636eaaba469558f02b4ed1e8220cbc7ddeea4fe986ad

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 22:36

Target

790c8d30d78be3df96b1636eaaba469558f02b4ed1e8220cbc7ddeea4fe986ad.exe
Size

91KB
MD5

9703224c3b301d2a78aa5a70ae5ebe0c
SHA1

c2b23d8ad82306392a7396e49db9c6d6a8825fb6
SHA256

790c8d30d78be3df96b1636eaaba469558f02b4ed1e8220cbc7ddeea4fe986ad
SHA512

230b3a1de9c81b35c36418fa86b2c42fa3dd74e38b73a90a3e7a2bb7bb795d89797547312cc6929d97d755233aa38b6098461fa97f0ea193f3e0283a3818bb5c
SSDEEP

1536:A3ZKTSnRkEQyqqq0Sy7wk4wwG0617F4yjhl3nTneCREhoG6Hc1qPV:e4ELfDUk1wGQyjP3nTneCRzG51qV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 908	1800	790c8d30d78be3df96b1636eaaba469558f02b4ed1e8220cbc7ddeea4fe986ad.exe	28
PID 1800 wrote to memory of 908	1800	790c8d30d78be3df96b1636eaaba469558f02b4ed1e8220cbc7ddeea4fe986ad.exe	28
PID 1800 wrote to memory of 908	1800	790c8d30d78be3df96b1636eaaba469558f02b4ed1e8220cbc7ddeea4fe986ad.exe	28

C:\Users\Admin\AppData\Local\Temp\790c8d30d78be3df96b1636eaaba469558f02b4ed1e8220cbc7ddeea4fe986ad.exe
"C:\Users\Admin\AppData\Local\Temp\790c8d30d78be3df96b1636eaaba469558f02b4ed1e8220cbc7ddeea4fe986ad.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 384
  2⤵
  PID:908

memory/908-57-0x000007FEFBE11000-0x000007FEFBE13000-memory.dmp

Filesize
8KB

Download
memory/1800-54-0x000007FEF3A90000-0x000007FEF44B3000-memory.dmp

Filesize
10.1MB

Download
memory/1800-55-0x000007FEF29F0000-0x000007FEF3A86000-memory.dmp

Filesize
16.6MB

Download