10ee2f7282dcf6adca9ab397fcadf19209e23ddbcf626ec489a08fa88cb11873

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 15:53

Target

10ee2f7282dcf6adca9ab397fcadf19209e23ddbcf626ec489a08fa88cb11873.exe
Size

258KB
MD5

81e2c4353499c266be0217e7f1beb890
SHA1

524b1dd76a5c976d60a82245456f6d535d8fb5b8
SHA256

10ee2f7282dcf6adca9ab397fcadf19209e23ddbcf626ec489a08fa88cb11873
SHA512

9c8bf8f2afdf16d8433b3abb4df4e70be13121af6f1f8a55e80264e31230adae9acb24f0dc1e5a806e3af102d17da3d6ade30780680a857e1c3cdfcd29936d45
SSDEEP

6144:yl8I5/CW2H9vUXPpnUFfdi/P69b1Fl93EKmdnA:ySIKvyBIfdiH6F95zwA

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 1172	1900	10ee2f7282dcf6adca9ab397fcadf19209e23ddbcf626ec489a08fa88cb11873.exe	27
PID 1900 wrote to memory of 1172	1900	10ee2f7282dcf6adca9ab397fcadf19209e23ddbcf626ec489a08fa88cb11873.exe	27
PID 1900 wrote to memory of 1172	1900	10ee2f7282dcf6adca9ab397fcadf19209e23ddbcf626ec489a08fa88cb11873.exe	27
PID 1900 wrote to memory of 1172	1900	10ee2f7282dcf6adca9ab397fcadf19209e23ddbcf626ec489a08fa88cb11873.exe	27

C:\Users\Admin\AppData\Local\Temp\10ee2f7282dcf6adca9ab397fcadf19209e23ddbcf626ec489a08fa88cb11873.exe
"C:\Users\Admin\AppData\Local\Temp\10ee2f7282dcf6adca9ab397fcadf19209e23ddbcf626ec489a08fa88cb11873.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 400
  2⤵
  PID:1172

memory/1900-54-0x0000000075A81000-0x0000000075A83000-memory.dmp

Filesize
8KB

Download
memory/1900-57-0x0000000074290000-0x000000007483B000-memory.dmp

Filesize
5.7MB

Download
memory/1900-58-0x0000000074290000-0x000000007483B000-memory.dmp

Filesize
5.7MB

Download