32a4e0c50625750a5476cf7e4ee963c60533f8f15941e6741a798382328c6667

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04-02-2024 01:36

Target

8de32b1db64333ec24c658508723808a.exe
Size

210KB
MD5

8de32b1db64333ec24c658508723808a
SHA1

6012d9b00fe593a628fd28ed9135921d87558e2c
SHA256

32a4e0c50625750a5476cf7e4ee963c60533f8f15941e6741a798382328c6667
SHA512

56991b62da160003a05e156627b8fe2c653f89e6cf715876ea5897be2969010eedd2be89c4d5ac6eb4954832bed0a49279b209046f66de820995190e4de4032b
SSDEEP

6144:QXiHfwvSh2h8CHWbRmHeRhY489MMr8tF2tF:ILR2wH6hNiMAv

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 2908	1472	8de32b1db64333ec24c658508723808a.exe	28
PID 1472 wrote to memory of 2908	1472	8de32b1db64333ec24c658508723808a.exe	28
PID 1472 wrote to memory of 2908	1472	8de32b1db64333ec24c658508723808a.exe	28
PID 1472 wrote to memory of 2908	1472	8de32b1db64333ec24c658508723808a.exe	28

C:\Users\Admin\AppData\Local\Temp\8de32b1db64333ec24c658508723808a.exe
"C:\Users\Admin\AppData\Local\Temp\8de32b1db64333ec24c658508723808a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 536
  2⤵
  PID:2908

memory/1472-0-0x0000000074890000-0x0000000074E3B000-memory.dmp

Filesize
5.7MB

Download
memory/1472-2-0x0000000002060000-0x00000000020A0000-memory.dmp

Filesize
256KB

Download
memory/1472-1-0x0000000074890000-0x0000000074E3B000-memory.dmp

Filesize
5.7MB

Download
memory/1472-4-0x0000000074890000-0x0000000074E3B000-memory.dmp

Filesize
5.7MB

Download
memory/1472-5-0x0000000002060000-0x00000000020A0000-memory.dmp

Filesize
256KB

Download
memory/2908-3-0x0000000001E50000-0x0000000001E51000-memory.dmp

Filesize
4KB

Download
memory/2908-6-0x0000000001E50000-0x0000000001E51000-memory.dmp

Filesize
4KB

Download