e7a678417234a6f4b7052db3f165e25f5938bbbc5dd03c921e178cfdfaa0e18b

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 18:19

Target

0b44cc975d5602a97bbf3de86874322f.exe
Size

45KB
MD5

0b44cc975d5602a97bbf3de86874322f
SHA1

85014ef3bc28c1bafec75fd57968b029927b8281
SHA256

e7a678417234a6f4b7052db3f165e25f5938bbbc5dd03c921e178cfdfaa0e18b
SHA512

04e706b8b6202479c2fff27b0f0918c504e402f4d5ae6a5bdc64efb7c4e3852711ccf60edc11a04927c8c6626731329abc08821d5a87eedaa6d85dbf6b7a9669
SSDEEP

768:vRnhuuEYdzIUqJCHTZ72xu1DM1K5wGRkITDhhRNh4YH2oJfk3wx22lulllYbXwX:5nhhblqJCHTZso4RwkITDhh54VCfk3wI

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2456	1924	0b44cc975d5602a97bbf3de86874322f.exe	18
PID 1924 wrote to memory of 2456	1924	0b44cc975d5602a97bbf3de86874322f.exe	18
PID 1924 wrote to memory of 2456	1924	0b44cc975d5602a97bbf3de86874322f.exe	18
PID 1924 wrote to memory of 2456	1924	0b44cc975d5602a97bbf3de86874322f.exe	18

C:\Users\Admin\AppData\Local\Temp\0b44cc975d5602a97bbf3de86874322f.exe
"C:\Users\Admin\AppData\Local\Temp\0b44cc975d5602a97bbf3de86874322f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 416
  2⤵
  PID:2456

memory/1924-1-0x0000000001D80000-0x0000000001DC0000-memory.dmp

Filesize
256KB

Download
memory/1924-2-0x00000000743B0000-0x000000007495B000-memory.dmp

Filesize
5.7MB

Download
memory/1924-0-0x00000000743B0000-0x000000007495B000-memory.dmp

Filesize
5.7MB

Download
memory/1924-5-0x0000000001D80000-0x0000000001DC0000-memory.dmp

Filesize
256KB

Download
memory/1924-4-0x00000000743B0000-0x000000007495B000-memory.dmp

Filesize
5.7MB

Download
memory/2456-3-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download