3c97385502fcfa3ff984626eda1461de3af1a9e197c5959583dda8ba401d8581

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 18:12

Target

Source Code/一元函数求导器/bin/DerivativeM.vshost.exe
Size

5KB
MD5

8bfc3551111a194ac0d59522ea8322a2
SHA1

6c6ead5dde243616cd882fca1204372e03125ec4
SHA256

0cb893cdf763c4cdbbedf895e24f69b446aebde6ec3d5b21b2a365e39284d356
SHA512

f5c9b2a878d18253fc6a12a118e974997bfbb6ce66d6e1bbb77e53619f58fe61557997478046c63f0e41d57be08ef0cbd906d5ffd2e5bbd1d4ab958698fae7c8
SSDEEP

96:qd1Z/cLMuJCu+XSxvpRnD5KrDAtSXWqnmWg:qXZ0vz+ixBR7MWomW

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2228	1740	DerivativeM.vshost.exe	28
PID 1740 wrote to memory of 2228	1740	DerivativeM.vshost.exe	28
PID 1740 wrote to memory of 2228	1740	DerivativeM.vshost.exe	28

C:\Users\Admin\AppData\Local\Temp\Source Code\一元函数求导器\bin\DerivativeM.vshost.exe
"C:\Users\Admin\AppData\Local\Temp\Source Code\一元函数求导器\bin\DerivativeM.vshost.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 360
  2⤵
  PID:2228

memory/1740-0-0x000007FEF5910000-0x000007FEF62AD000-memory.dmp

Filesize
9.6MB

Download
memory/1740-1-0x0000000000410000-0x0000000000490000-memory.dmp

Filesize
512KB

Download
memory/1740-3-0x000007FEF5910000-0x000007FEF62AD000-memory.dmp

Filesize
9.6MB

Download
memory/1740-4-0x0000000000410000-0x0000000000490000-memory.dmp

Filesize
512KB

Download
memory/2228-2-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download