5518980510be79f425518145724d0e7f7564854667cdb8b7d9f6c0112401eebd

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 08:38

Target

LocoyBugReport.exe
Size

104KB
MD5

400b22885155fcefce71c87b6d4c9772
SHA1

1f1312ed89cb51e8cb0525a8aa37e49ba3fea692
SHA256

0eb7a96f22c44b6fb3ef7efbd61fb5b14ba6c6ae32091dff6f03b0c461bcb8a4
SHA512

10fca13a8bea6e0cdb3785e218f9bc0e3f5d85790b5e2dfba349dd39f8af5bed5af42399865414e3d622d0e69004401be5197d6f9cc92b8d6354bcc78670c7d4
SSDEEP

1536://1aDBxIZwHd0mGk/3MSGQw1PSJyWGQbkvEMy7PN6s://+IZMd0mGk/jw1PSJyWG6aL8P

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2032	2028	LocoyBugReport.exe	28
PID 2028 wrote to memory of 2032	2028	LocoyBugReport.exe	28
PID 2028 wrote to memory of 2032	2028	LocoyBugReport.exe	28

C:\Users\Admin\AppData\Local\Temp\LocoyBugReport.exe
"C:\Users\Admin\AppData\Local\Temp\LocoyBugReport.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 392
  2⤵
  PID:2032

memory/2028-0-0x000007FEF5EBE000-0x000007FEF5EBF000-memory.dmp

Filesize
4KB

Download
memory/2028-1-0x000007FEF5C00000-0x000007FEF659D000-memory.dmp

Filesize
9.6MB

Download
memory/2028-3-0x000007FEF5C00000-0x000007FEF659D000-memory.dmp

Filesize
9.6MB

Download
memory/2032-2-0x0000000000470000-0x0000000000471000-memory.dmp

Filesize
4KB

Download
memory/2032-4-0x0000000000470000-0x0000000000471000-memory.dmp

Filesize
4KB

Download