e51d75f9516e8368a182cbebdcd9f0ca46fc12180b96f9b24416df792134274f

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 04:01

Target

e51d75f9516e8368a182cbebdcd9f0ca46fc12180b96f9b24416df792134274f.exe
Size

43KB
MD5

c836c98e2584647123b08139d8ee0784
SHA1

7af0b49a2c881f1d2716a488d95deddbe51cf97b
SHA256

e51d75f9516e8368a182cbebdcd9f0ca46fc12180b96f9b24416df792134274f
SHA512

1fd3d91a37408f3eaf89342a875ca651e524e7b6fc86a3dae0158517c56ff03302cc0d891fc15300fe4c054435632f0065f611c561de642cc0ab8e9a1425062f
SSDEEP

768:BK+JJFGoC3qKqWD4WStv6E5G4MTMPEqPFbIhQOd:BZJJnC3QWsJ5HLsqw

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2488	2868	e51d75f9516e8368a182cbebdcd9f0ca46fc12180b96f9b24416df792134274f.exe	28
PID 2868 wrote to memory of 2488	2868	e51d75f9516e8368a182cbebdcd9f0ca46fc12180b96f9b24416df792134274f.exe	28
PID 2868 wrote to memory of 2488	2868	e51d75f9516e8368a182cbebdcd9f0ca46fc12180b96f9b24416df792134274f.exe	28

C:\Users\Admin\AppData\Local\Temp\e51d75f9516e8368a182cbebdcd9f0ca46fc12180b96f9b24416df792134274f.exe
"C:\Users\Admin\AppData\Local\Temp\e51d75f9516e8368a182cbebdcd9f0ca46fc12180b96f9b24416df792134274f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 368
  2⤵
  PID:2488

memory/2488-3-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2868-0-0x000007FEF5AC0000-0x000007FEF645D000-memory.dmp

Filesize
9.6MB

Download
memory/2868-1-0x0000000000470000-0x00000000004F0000-memory.dmp

Filesize
512KB

Download
memory/2868-2-0x000007FEF5AC0000-0x000007FEF645D000-memory.dmp

Filesize
9.6MB

Download
memory/2868-4-0x000007FEF5AC0000-0x000007FEF645D000-memory.dmp

Filesize
9.6MB

Download