e6fb0a19684d59cd506c01bf7d622c0f06530cabc179147ff3b9c255de341f9a

Analysis

max time kernel
35s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 19:34

Target

e6fb0a19684d59cd506c01bf7d622c0f06530cabc179147ff3b9c255de341f9a.exe
Size

147KB
MD5

ebe74eecf14f25787a1aaeed5151e2f6
SHA1

d0b6407f23977f116afc28c0f02988523c8420f3
SHA256

e6fb0a19684d59cd506c01bf7d622c0f06530cabc179147ff3b9c255de341f9a
SHA512

9a9762814d9a21442abd811e229c4f51437e27b2b0ac9f03eb3ffca81ce85a429476f4f517a4daca23a8aeec0eaa3bb24704357ae43a7e5dabeb21030bbe262d
SSDEEP

3072:RitBmOkXOCRnbc/wVh4Qiy+gBZ3ZXHPkVtHXTl:yUtnbcoVhRBZ3ZXvkV9XTl

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1356	2012	e6fb0a19684d59cd506c01bf7d622c0f06530cabc179147ff3b9c255de341f9a.exe	27
PID 2012 wrote to memory of 1356	2012	e6fb0a19684d59cd506c01bf7d622c0f06530cabc179147ff3b9c255de341f9a.exe	27
PID 2012 wrote to memory of 1356	2012	e6fb0a19684d59cd506c01bf7d622c0f06530cabc179147ff3b9c255de341f9a.exe	27
PID 2012 wrote to memory of 1356	2012	e6fb0a19684d59cd506c01bf7d622c0f06530cabc179147ff3b9c255de341f9a.exe	27

C:\Users\Admin\AppData\Local\Temp\e6fb0a19684d59cd506c01bf7d622c0f06530cabc179147ff3b9c255de341f9a.exe
"C:\Users\Admin\AppData\Local\Temp\e6fb0a19684d59cd506c01bf7d622c0f06530cabc179147ff3b9c255de341f9a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 408
  2⤵
  PID:1356

memory/2012-54-0x0000000075841000-0x0000000075843000-memory.dmp

Filesize
8KB

Download
memory/2012-55-0x0000000074300000-0x00000000748AB000-memory.dmp

Filesize
5.7MB

Download
memory/2012-58-0x0000000074300000-0x00000000748AB000-memory.dmp

Filesize
5.7MB

Download