d466b60b3d445b37356b95a69c7b3d2d708225c110d7ec6d3e42b9ba70ea5b2c

Analysis

max time kernel
33s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
12/03/2023, 14:02

Target

KeyMapper.exe
Size

350KB
MD5

bae38e899ddcfc2b3cca65e280b51c27
SHA1

5b8a3ce687052c70d3ec524945a70fc4a68f5b5b
SHA256

d466b60b3d445b37356b95a69c7b3d2d708225c110d7ec6d3e42b9ba70ea5b2c
SHA512

c64c2d14453aefa6b83bbec6eefba2fdb9351639daf5c572c3d5451535951873c2730cd0e7f55beabf7f6f951fc5959265d6926582ee5de7df3ba46f9efecfc0
SSDEEP

6144:MaEfMe/4X/g+V2FD3JFi8YaEwHah2uHYpTn81i01CB/TK9rsXc7uJUJnnG3jj:MaLo3K3ahaMcqDJXKuJU

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 316	1260	KeyMapper.exe	28
PID 1260 wrote to memory of 316	1260	KeyMapper.exe	28
PID 1260 wrote to memory of 316	1260	KeyMapper.exe	28

C:\Users\Admin\AppData\Local\Temp\KeyMapper.exe
"C:\Users\Admin\AppData\Local\Temp\KeyMapper.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 1328
  2⤵
  PID:316

memory/316-59-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/1260-54-0x0000000000190000-0x00000000001EC000-memory.dmp

Filesize
368KB

Download
memory/1260-57-0x0000000002030000-0x00000000020B0000-memory.dmp

Filesize
512KB

Download
memory/1260-58-0x0000000002030000-0x00000000020B0000-memory.dmp

Filesize
512KB

Download
memory/1260-60-0x0000000002030000-0x00000000020B0000-memory.dmp

Filesize
512KB

Download