a1082d01ede1f5fa700be2420ec96047a699d0579c15ddb2f54233a24ac3a7e9

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01-01-2024 14:50

Target

a4704be3a77f989693188a4a505b62719ffe87718f8891ab5d3e1de1b1a57572.exe
Size

565KB
MD5

587163ebb29d37762be9b65b4553733a
SHA1

1688aadda5db2d63fdd296edd65a8063db1a3eec
SHA256

a4704be3a77f989693188a4a505b62719ffe87718f8891ab5d3e1de1b1a57572
SHA512

3222f727beb7e8b5d512355863bd0d280b7a6303a1a770345e9d48b48b4c8d37f10a78085ad1d82db265c3a97c2651856366975403aa8656c0127961208b589b
SSDEEP

6144:vQfvuXwa/F2wHHG/BY1oDShdi6QgEOr26QD3T:OmX37H7hA6P26Mj

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a4704be3a77f989693188a4a505b62719ffe87718f8891ab5d3e1de1b1a57572.exe

description	pid	process	target process
PID 2152 wrote to memory of 1696	2152	a4704be3a77f989693188a4a505b62719ffe87718f8891ab5d3e1de1b1a57572.exe	dw20.exe
PID 2152 wrote to memory of 1696	2152	a4704be3a77f989693188a4a505b62719ffe87718f8891ab5d3e1de1b1a57572.exe	dw20.exe
PID 2152 wrote to memory of 1696	2152	a4704be3a77f989693188a4a505b62719ffe87718f8891ab5d3e1de1b1a57572.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\a4704be3a77f989693188a4a505b62719ffe87718f8891ab5d3e1de1b1a57572.exe
"C:\Users\Admin\AppData\Local\Temp\a4704be3a77f989693188a4a505b62719ffe87718f8891ab5d3e1de1b1a57572.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 480
  2⤵
  PID:1696

memory/1696-5-0x0000000000460000-0x0000000000461000-memory.dmp

Filesize
4KB

Download
memory/2152-1-0x0000000000A50000-0x0000000000AD0000-memory.dmp

Filesize
512KB

Download
memory/2152-2-0x000007FEF5B90000-0x000007FEF652D000-memory.dmp

Filesize
9.6MB

Download
memory/2152-0-0x000007FEF5B90000-0x000007FEF652D000-memory.dmp

Filesize
9.6MB

Download
memory/2152-3-0x0000000000A50000-0x0000000000AD0000-memory.dmp

Filesize
512KB

Download
memory/2152-4-0x0000000000A50000-0x0000000000AD0000-memory.dmp

Filesize
512KB

Download
memory/2152-6-0x000007FEF5B90000-0x000007FEF652D000-memory.dmp

Filesize
9.6MB

Download