02e1bccb80a7dd17237b5114864ecd577354e02394b1a8feb3ee1a670fa13a8a

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 06:36

Target

FileSplitter.exe
Size

284KB
MD5

4a07bd3f54db973b504aab3958114b1d
SHA1

278609a2de4e4c71dc90a049ee915143cba78c88
SHA256

5abbcb044c1c1b86711b73378019ebbc55c3fda6ca179062c4fad0fcc236021d
SHA512

0cb0525fb9e7807c5f9c80e7de5029409b0ef5890934b56261c05faa1e0d18c929257b9688ba4f55fd75351970387ceb59c2d91f417a6abb8851250a38010f34
SSDEEP

3072:96DnXcjr75G5lxtDYYYYYYYYYYYYYYYYYqYYYYYYYYYYYYYYYYYYYYYYYYYYYYYh:98C/s5z7uONAac5z7uON

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 2764	1648	FileSplitter.exe	30
PID 1648 wrote to memory of 2764	1648	FileSplitter.exe	30
PID 1648 wrote to memory of 2764	1648	FileSplitter.exe	30

C:\Users\Admin\AppData\Local\Temp\FileSplitter.exe
"C:\Users\Admin\AppData\Local\Temp\FileSplitter.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 464
  2⤵
  PID:2764

memory/1648-0-0x000007FEF4EAE000-0x000007FEF4EAF000-memory.dmp

Filesize
4KB

Download
memory/1648-1-0x000007FEF4BF0000-0x000007FEF558D000-memory.dmp

Filesize
9.6MB

Download
memory/1648-2-0x000007FEF4BF0000-0x000007FEF558D000-memory.dmp

Filesize
9.6MB

Download
memory/1648-3-0x000007FEF4BF0000-0x000007FEF558D000-memory.dmp

Filesize
9.6MB

Download
memory/1648-5-0x000007FEF4BF0000-0x000007FEF558D000-memory.dmp

Filesize
9.6MB

Download
memory/2764-4-0x0000000000460000-0x0000000000461000-memory.dmp

Filesize
4KB

Download