f32cf454683adf3154fecb92be0e431073bbd713d76cb046e0141f2a9b5fbbf6

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 13:20

Target

te port scanner/PortScanner.vshost.exe
Size

5KB
MD5

d9086aab959707dd1a8643f3df70db9d
SHA1

31e855c2fbd8f69b0cc149696e3fd9ca887a30c4
SHA256

07470371b6c705a49965ae5d98e26450b9fef50e4ba4851de91e29e9721ab197
SHA512

7ce65c130e3e13683a0265fb5171d2a869f0c5059ee1e38728736963c832af4cebfe9b2384b7e12beac21f0414c54ed021d331d4f51ebb1ed5f34d6e709eca57
SSDEEP

48:6PYfPQwY7B/6U7ghNb6REKUh7U2+Ivpo/fD3K/zDbdstXe8ZWfZEpK5zhGB5WguN:BPBYHguj2xvpafD3KrDbdsfWO0VmWgO

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 1760	2340	PortScanner.vshost.exe	28
PID 2340 wrote to memory of 1760	2340	PortScanner.vshost.exe	28
PID 2340 wrote to memory of 1760	2340	PortScanner.vshost.exe	28

C:\Users\Admin\AppData\Local\Temp\te port scanner\PortScanner.vshost.exe
"C:\Users\Admin\AppData\Local\Temp\te port scanner\PortScanner.vshost.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 352
  2⤵
  PID:1760

memory/1760-2-0x0000000000460000-0x0000000000461000-memory.dmp

Filesize
4KB

Download
memory/2340-0-0x000007FEF5D1E000-0x000007FEF5D1F000-memory.dmp

Filesize
4KB

Download
memory/2340-1-0x000007FEF5A60000-0x000007FEF63FD000-memory.dmp

Filesize
9.6MB

Download
memory/2340-3-0x000007FEF5A60000-0x000007FEF63FD000-memory.dmp

Filesize
9.6MB

Download