4eeb5d8830e378c5c351d8ea1f8b370364e6ab530573e1f609d8d459e3f23b1a

Analysis

max time kernel
120s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 18:55

Target

LuminosityLink+builder\Builder\builder_con2trip.exe
Size

103KB
MD5

a10cd7acbdbff06d18bc5c00d40d3a07
SHA1

40548f86194adcadd13d9d96d85b33647a35f0a2
SHA256

55fec5eca1c1e2a0304088cf9eff5f85df1263d3bb178f0834de26168e4014bb
SHA512

fcbe9fd7a943de79cd367b0091c4ccba094e8e03835819e435dc1209a588df6fb98c0df5ed6f81e8135ace59736bf4c61c87dcc9b31d89ecb83afb7fea3ae206
SSDEEP

3072:/IRxwLRMcR9aBeWvfxLWDwreWJ2NJgfV4NY:omLbR9JWJWwJYJgf

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 3044	1812	builder_con2trip.exe	28
PID 1812 wrote to memory of 3044	1812	builder_con2trip.exe	28
PID 1812 wrote to memory of 3044	1812	builder_con2trip.exe	28

C:\Users\Admin\AppData\Local\Temp\LuminosityLink+builder\Builder\builder_con2trip.exe
"C:\Users\Admin\AppData\Local\Temp\LuminosityLink+builder\Builder\builder_con2trip.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 468
  2⤵
  PID:3044

memory/1812-0-0x000007FEF598E000-0x000007FEF598F000-memory.dmp

Filesize
4KB

Download
memory/1812-1-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

Filesize
9.6MB

Download
memory/1812-2-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

Filesize
9.6MB

Download
memory/1812-3-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

Filesize
9.6MB

Download
memory/1812-5-0x000007FEF598E000-0x000007FEF598F000-memory.dmp

Filesize
4KB

Download
memory/1812-6-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

Filesize
9.6MB

Download
memory/3044-4-0x0000000001DA0000-0x0000000001DA1000-memory.dmp

Filesize
4KB

Download