8bdeb5a9779798cb13a29fe7e54751dafa6ef70fa3a4e16069ea3c77442732cf

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02-05-2024 00:18

Target

8bdeb5a9779798cb13a29fe7e54751dafa6ef70fa3a4e16069ea3c77442732cf.exe
Size

222KB
MD5

7a87f03a89b15ce00d59a490d76fb4f9
SHA1

2d2afca75d0c840bd215f6d22c7ed53c6c4a02df
SHA256

8bdeb5a9779798cb13a29fe7e54751dafa6ef70fa3a4e16069ea3c77442732cf
SHA512

e6de9ee9af6dd1fce4da8067d73111d217f85e61b793a77961968d783b9915fc592b7ce1776bab9f15aeee24363d925be86f861f50abab6477527494c5155c09
SSDEEP

3072:YsXRmUIMitPMQLse27vc+Eld+xZp2vPRL1tT06zJoxAWBcKpSP//dwlm2:ZR5ITMQLseGk7RZBGxAycKpSPX21

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2916	2848	8bdeb5a9779798cb13a29fe7e54751dafa6ef70fa3a4e16069ea3c77442732cf.exe	28
PID 2848 wrote to memory of 2916	2848	8bdeb5a9779798cb13a29fe7e54751dafa6ef70fa3a4e16069ea3c77442732cf.exe	28
PID 2848 wrote to memory of 2916	2848	8bdeb5a9779798cb13a29fe7e54751dafa6ef70fa3a4e16069ea3c77442732cf.exe	28

C:\Users\Admin\AppData\Local\Temp\8bdeb5a9779798cb13a29fe7e54751dafa6ef70fa3a4e16069ea3c77442732cf.exe
"C:\Users\Admin\AppData\Local\Temp\8bdeb5a9779798cb13a29fe7e54751dafa6ef70fa3a4e16069ea3c77442732cf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 456
  2⤵
  PID:2916

memory/2848-0-0x000007FEF579E000-0x000007FEF579F000-memory.dmp

Filesize
4KB

Download
memory/2848-1-0x000007FEF54E0000-0x000007FEF5E7D000-memory.dmp

Filesize
9.6MB

Download
memory/2848-2-0x000007FEF54E0000-0x000007FEF5E7D000-memory.dmp

Filesize
9.6MB

Download
memory/2848-3-0x000007FEF54E0000-0x000007FEF5E7D000-memory.dmp

Filesize
9.6MB

Download
memory/2848-5-0x000007FEF579E000-0x000007FEF579F000-memory.dmp

Filesize
4KB

Download
memory/2848-6-0x000007FEF54E0000-0x000007FEF5E7D000-memory.dmp

Filesize
9.6MB

Download
memory/2916-4-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2916-7-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download