ad6ca8823971be249382ec6b4ae1b34d60b33e8ff3e188a07197ad78085618c9

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 01:14

Target

bb6cc29d3d80bdb67d2aa773fab2f766cfbf99d68474bc866ee6026796519cdd.exe
Size

1.0MB
MD5

2d5d7f03a0710ac25a3641c302dd13c3
SHA1

efbd37b76f1054175e8398051044e9011966bfd1
SHA256

bb6cc29d3d80bdb67d2aa773fab2f766cfbf99d68474bc866ee6026796519cdd
SHA512

f66d26077b7a137004dd2e73f853b3d8b194308068704750c76fa1bf93325546a4c1cd75652bb2eb8bba2d50eb582bdbbc6a55d7144567b414a97cf696ba963d
SSDEEP

24576:O6WJBVOrHD6WJBVOrHw6WJBVOrHw6WJBVOrHUDKkWJBVOrH:TYzOr2YzOrVYzOrVYzOrSYzOr

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2488	2480	bb6cc29d3d80bdb67d2aa773fab2f766cfbf99d68474bc866ee6026796519cdd.exe	28
PID 2480 wrote to memory of 2488	2480	bb6cc29d3d80bdb67d2aa773fab2f766cfbf99d68474bc866ee6026796519cdd.exe	28
PID 2480 wrote to memory of 2488	2480	bb6cc29d3d80bdb67d2aa773fab2f766cfbf99d68474bc866ee6026796519cdd.exe	28

C:\Users\Admin\AppData\Local\Temp\bb6cc29d3d80bdb67d2aa773fab2f766cfbf99d68474bc866ee6026796519cdd.exe
"C:\Users\Admin\AppData\Local\Temp\bb6cc29d3d80bdb67d2aa773fab2f766cfbf99d68474bc866ee6026796519cdd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 476
  2⤵
  PID:2488

memory/2480-0-0x000007FEF54B0000-0x000007FEF5E4D000-memory.dmp

Filesize
9.6MB

Download
memory/2480-1-0x0000000000AB0000-0x0000000000B30000-memory.dmp

Filesize
512KB

Download
memory/2480-2-0x000007FEF54B0000-0x000007FEF5E4D000-memory.dmp

Filesize
9.6MB

Download
memory/2480-3-0x0000000000AB0000-0x0000000000B30000-memory.dmp

Filesize
512KB

Download
memory/2480-5-0x000007FEF54B0000-0x000007FEF5E4D000-memory.dmp

Filesize
9.6MB

Download
memory/2480-6-0x0000000000AB0000-0x0000000000B30000-memory.dmp

Filesize
512KB

Download
memory/2480-7-0x0000000000AB0000-0x0000000000B30000-memory.dmp

Filesize
512KB

Download
memory/2488-4-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download