cbb3ddf0b98319376fb7e376431da9074d636ba9b8a04323f3032c5eff6f67e7

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 04:31 UTC

Target

7948a227dd12684525a7116f0fc355ad.exe
Size

61KB
MD5

7948a227dd12684525a7116f0fc355ad
SHA1

a0f3dff5e05b2e7ed751261394220e8020adfec9
SHA256

cbb3ddf0b98319376fb7e376431da9074d636ba9b8a04323f3032c5eff6f67e7
SHA512

0375e8592061e723a1eff7f3b4524e3e56de8756fd75b7889161560f42c41f2a07441143feedfca515cb114827980fab77b3ec58c904453bdf2b8b16bee91a17
SSDEEP

1536:ijA8E2jotyEve/iT0AQR/SRL1WC34x2a2L:WEKEyEUiYuBWC3va2

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2200	2376	7948a227dd12684525a7116f0fc355ad.exe	28
PID 2376 wrote to memory of 2200	2376	7948a227dd12684525a7116f0fc355ad.exe	28
PID 2376 wrote to memory of 2200	2376	7948a227dd12684525a7116f0fc355ad.exe	28
PID 2376 wrote to memory of 2200	2376	7948a227dd12684525a7116f0fc355ad.exe	28

C:\Users\Admin\AppData\Local\Temp\7948a227dd12684525a7116f0fc355ad.exe
"C:\Users\Admin\AppData\Local\Temp\7948a227dd12684525a7116f0fc355ad.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 488
  2⤵
  PID:2200

memory/2200-3-0x00000000024A0000-0x00000000024A1000-memory.dmp

Filesize
4KB

Download
memory/2376-0-0x0000000074430000-0x00000000749DB000-memory.dmp

Filesize
5.7MB

Download
memory/2376-1-0x0000000074430000-0x00000000749DB000-memory.dmp

Filesize
5.7MB

Download
memory/2376-2-0x00000000005A0000-0x00000000005E0000-memory.dmp

Filesize
256KB

Download
memory/2376-4-0x0000000074430000-0x00000000749DB000-memory.dmp

Filesize
5.7MB

Download
memory/2376-5-0x00000000005A0000-0x00000000005E0000-memory.dmp

Filesize
256KB

Download