339efe3dd02741e9978f5386f7bd8fa459eb377dc6a031f5256e2b2ce691e24a

Analysis

max time kernel
23s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 05:51

Target

339efe3dd02741e9978f5386f7bd8fa459eb377dc6a031f5256e2b2ce691e24a.exe
Size

420KB
MD5

0b874dd0223957b0d6de58a7d4000ef0
SHA1

69a68afa5fe7c694880affc3e1a6188de487c49b
SHA256

339efe3dd02741e9978f5386f7bd8fa459eb377dc6a031f5256e2b2ce691e24a
SHA512

6f42ce7104b23919c9639c9dc3c613af961fd68fca8bec8ef9eb68081614156446089c46777775e6b7c19efeaa47181e3599342fb7105ae0d72715c497673583
SSDEEP

12288:5VODkOEYI13Zp5/GggLZu1oDpFLiCLEYSw8Fsdb0EuJ0:7OExJk81oDbBLEYSw86gBJ0

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1012 wrote to memory of 1388	1012	339efe3dd02741e9978f5386f7bd8fa459eb377dc6a031f5256e2b2ce691e24a.exe	28
PID 1012 wrote to memory of 1388	1012	339efe3dd02741e9978f5386f7bd8fa459eb377dc6a031f5256e2b2ce691e24a.exe	28
PID 1012 wrote to memory of 1388	1012	339efe3dd02741e9978f5386f7bd8fa459eb377dc6a031f5256e2b2ce691e24a.exe	28
PID 1012 wrote to memory of 1388	1012	339efe3dd02741e9978f5386f7bd8fa459eb377dc6a031f5256e2b2ce691e24a.exe	28

C:\Users\Admin\AppData\Local\Temp\339efe3dd02741e9978f5386f7bd8fa459eb377dc6a031f5256e2b2ce691e24a.exe
"C:\Users\Admin\AppData\Local\Temp\339efe3dd02741e9978f5386f7bd8fa459eb377dc6a031f5256e2b2ce691e24a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1012
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 404
  2⤵
  PID:1388

memory/1012-54-0x00000000763F1000-0x00000000763F3000-memory.dmp

Filesize
8KB

Download
memory/1012-56-0x0000000074AD0000-0x000000007507B000-memory.dmp

Filesize
5.7MB

Download
memory/1012-58-0x0000000074AD0000-0x000000007507B000-memory.dmp

Filesize
5.7MB

Download