9a7d0127083689bce4f8b329ea9cb963662efa977b950147db729b85d06f6e69

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 00:11

Target

Homebuh.exe
Size

20KB
MD5

2fdbf920d2b84a3dc5ccc6ed0380af72
SHA1

ee66099f568641c09f5b915adf136295245b8b4e
SHA256

51d78c14e079e6c7dd5c49d0fd39f07d9f0428c0413a7ed4815eba437a83ef92
SHA512

3bd2f0c7ed271db478b4e4017b194b4996f7450a4cd1dcc84972d83939fb9d6d306e2b164c418f553220c4fe00e3be49e8596ef31600691a89166736908ed7fd
SSDEEP

96:i9EOLX0pOaBf0JUPbpqNtZmE9QAOZMwayWa6o4hE6zNt:96XuOaBsmzpqNOE9Q1Mwamb4ht

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 2944	1812	Homebuh.exe	28
PID 1812 wrote to memory of 2944	1812	Homebuh.exe	28
PID 1812 wrote to memory of 2944	1812	Homebuh.exe	28

C:\Users\Admin\AppData\Local\Temp\Homebuh.exe
"C:\Users\Admin\AppData\Local\Temp\Homebuh.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 368
  2⤵
  PID:2944

memory/1812-0-0x000007FEF598E000-0x000007FEF598F000-memory.dmp

Filesize
4KB

Download
memory/1812-1-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

Filesize
9.6MB

Download
memory/1812-3-0x000007FEF598E000-0x000007FEF598F000-memory.dmp

Filesize
4KB

Download
memory/1812-4-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

Filesize
9.6MB

Download
memory/2944-2-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download