432124b8872c7f2f672251d54e190bd05aa530c0987743b61664b353da94078a

Analysis

max time kernel
121s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 00:36

Target

1d5765b9df727c0f5ab4c3ea702acd20.exe
Size

152KB
MD5

1d5765b9df727c0f5ab4c3ea702acd20
SHA1

2dbc6339a54a82b523b535d575125f382362b466
SHA256

432124b8872c7f2f672251d54e190bd05aa530c0987743b61664b353da94078a
SHA512

1c51b1300c9a1f3ab9857a48d0786075018f0f2c49e78a055337f95341879c083d17ff9fa39d1524e83e8de0f17be67e48015bb2a5b1914cf77d040db065d21e
SSDEEP

3072:wkkqP2/fqysi/Fg8sWQwKkNWmSDW62b2:/csi9rsWQwbNWmaA

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2804	1972	1d5765b9df727c0f5ab4c3ea702acd20.exe	27
PID 1972 wrote to memory of 2804	1972	1d5765b9df727c0f5ab4c3ea702acd20.exe	27
PID 1972 wrote to memory of 2804	1972	1d5765b9df727c0f5ab4c3ea702acd20.exe	27
PID 1972 wrote to memory of 2804	1972	1d5765b9df727c0f5ab4c3ea702acd20.exe	27

C:\Users\Admin\AppData\Local\Temp\1d5765b9df727c0f5ab4c3ea702acd20.exe
"C:\Users\Admin\AppData\Local\Temp\1d5765b9df727c0f5ab4c3ea702acd20.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 416
  2⤵
  PID:2804

memory/1972-0-0x00000000744E0000-0x0000000074A8B000-memory.dmp

Filesize
5.7MB

Download
memory/1972-2-0x0000000000CE0000-0x0000000000D20000-memory.dmp

Filesize
256KB

Download
memory/1972-1-0x00000000744E0000-0x0000000074A8B000-memory.dmp

Filesize
5.7MB

Download
memory/1972-4-0x00000000744E0000-0x0000000074A8B000-memory.dmp

Filesize
5.7MB

Download
memory/1972-5-0x0000000000CE0000-0x0000000000D20000-memory.dmp

Filesize
256KB

Download
memory/2804-3-0x0000000000530000-0x0000000000531000-memory.dmp

Filesize
4KB

Download
memory/2804-6-0x0000000000530000-0x0000000000531000-memory.dmp

Filesize
4KB

Download