d3ed48a9f66e5160b643b7bab84b73ef94f5ce9ec49dd699d70f90f39b8d19f2

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
07/06/2024, 19:08

Target

VirusShare_b1a63a902650fbb4ccf4baf006d9ce40.exe
Size

591KB
MD5

b1a63a902650fbb4ccf4baf006d9ce40
SHA1

cba9c557929f10251eb2cd44a967acf55a82c621
SHA256

d3ed48a9f66e5160b643b7bab84b73ef94f5ce9ec49dd699d70f90f39b8d19f2
SHA512

dc1f5954d4f1a27b8e30a8f593fa2196c8128e61cb8d9bd931949a117ead77427103cc514d467f6499cd4b294503fa51aecaac44772df774029251d74da186b1
SSDEEP

12288:0WMiZSHzcNeTsJdLzQjTpQm8qq3X/YceHiD+oP3D0Mw36ze7Z:NFSYNesOTOF1Qc3trtDze7Z

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2240	2108	VirusShare_b1a63a902650fbb4ccf4baf006d9ce40.exe	29
PID 2108 wrote to memory of 2240	2108	VirusShare_b1a63a902650fbb4ccf4baf006d9ce40.exe	29
PID 2108 wrote to memory of 2240	2108	VirusShare_b1a63a902650fbb4ccf4baf006d9ce40.exe	29

C:\Users\Admin\AppData\Local\Temp\VirusShare_b1a63a902650fbb4ccf4baf006d9ce40.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare_b1a63a902650fbb4ccf4baf006d9ce40.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 400
  2⤵
  PID:2240

memory/2108-0-0x000007FEF53EE000-0x000007FEF53EF000-memory.dmp

Filesize
4KB

Download
memory/2108-1-0x000007FEF5130000-0x000007FEF5ACD000-memory.dmp

Filesize
9.6MB

Download
memory/2108-2-0x000007FEF5130000-0x000007FEF5ACD000-memory.dmp

Filesize
9.6MB

Download
memory/2108-4-0x000007FEF53EE000-0x000007FEF53EF000-memory.dmp

Filesize
4KB

Download
memory/2108-5-0x000007FEF5130000-0x000007FEF5ACD000-memory.dmp

Filesize
9.6MB

Download
memory/2240-3-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download