46bed9243a79250325840b02bf7547cc10aaf5cb9c08ef121ff3e809e9152bcc

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 07:38

Target

125929746b40379a301f2e549cb0df26.exe
Size

16.6MB
MD5

125929746b40379a301f2e549cb0df26
SHA1

c58a6aee4b7a800beab355a3291a6738e506d617
SHA256

46bed9243a79250325840b02bf7547cc10aaf5cb9c08ef121ff3e809e9152bcc
SHA512

1368768d9383c9591bede9bc389d3c08b82adfbf8ee69905bb961c6d34c8c750af3107e3d7f25a1d61eac0cc5b5a501914f6a41942d959b9020eba357c931ede
SSDEEP

393216:SZpp7yHmQtqT0Mzv8N5fT4BgRtbxDZ/TEK5+4dLhwUPAa:SZv7yGQ8zv6574BgXxN/TEKxl3n

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 3004	2244	125929746b40379a301f2e549cb0df26.exe	28
PID 2244 wrote to memory of 3004	2244	125929746b40379a301f2e549cb0df26.exe	28
PID 2244 wrote to memory of 3004	2244	125929746b40379a301f2e549cb0df26.exe	28
PID 2244 wrote to memory of 3004	2244	125929746b40379a301f2e549cb0df26.exe	28

C:\Users\Admin\AppData\Local\Temp\125929746b40379a301f2e549cb0df26.exe
"C:\Users\Admin\AppData\Local\Temp\125929746b40379a301f2e549cb0df26.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 528
  2⤵
  PID:3004

memory/2244-0-0x00000000747F0000-0x0000000074D9B000-memory.dmp

Filesize
5.7MB

Download
memory/2244-1-0x00000000747F0000-0x0000000074D9B000-memory.dmp

Filesize
5.7MB

Download
memory/2244-2-0x00000000009C0000-0x0000000000A00000-memory.dmp

Filesize
256KB

Download
memory/2244-6-0x00000000747F0000-0x0000000074D9B000-memory.dmp

Filesize
5.7MB

Download
memory/2244-7-0x00000000009C0000-0x0000000000A00000-memory.dmp

Filesize
256KB

Download
memory/3004-5-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download
memory/3004-8-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download