27120c50d8beca9b037c8a191147654a6d5baeacb6a07110081687d058204afd

Analysis

max time kernel
15s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-09-2024 19:10

Target

27120c50d8beca9b037c8a191147654a6d5baeacb6a07110081687d058204afd.exe
Size

239KB
MD5

5845db51b5dd9d17ae390cf0ee34e67b
SHA1

973134067cddaffe656a2f83a91693c0c6f0ee8e
SHA256

27120c50d8beca9b037c8a191147654a6d5baeacb6a07110081687d058204afd
SHA512

bc053bd22fda9b57e9f99d984ad1f1a1861aa78eebb1ee43c5871c8fe53b438432f645b0fc6905f6cfa0f52a90003a5f0475d04243e6320441d61b0ea029f12d
SSDEEP

3072:hsXRmUIMitiMQose27vc+Eld+xZp2vPRL1tT06zJoxAWBcKpSP//dwR1l9B4hTb:GR5IuMQoseGk7RZBGxAycKpSPX2pUF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2648	2980	27120c50d8beca9b037c8a191147654a6d5baeacb6a07110081687d058204afd.exe	30
PID 2980 wrote to memory of 2648	2980	27120c50d8beca9b037c8a191147654a6d5baeacb6a07110081687d058204afd.exe	30
PID 2980 wrote to memory of 2648	2980	27120c50d8beca9b037c8a191147654a6d5baeacb6a07110081687d058204afd.exe	30

C:\Users\Admin\AppData\Local\Temp\27120c50d8beca9b037c8a191147654a6d5baeacb6a07110081687d058204afd.exe
"C:\Users\Admin\AppData\Local\Temp\27120c50d8beca9b037c8a191147654a6d5baeacb6a07110081687d058204afd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 456
  2⤵
  PID:2648

memory/2648-4-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2980-0-0x000007FEF526E000-0x000007FEF526F000-memory.dmp

Filesize
4KB

Download
memory/2980-1-0x000007FEF4FB0000-0x000007FEF594D000-memory.dmp

Filesize
9.6MB

Download
memory/2980-2-0x000007FEF4FB0000-0x000007FEF594D000-memory.dmp

Filesize
9.6MB

Download
memory/2980-3-0x000007FEF4FB0000-0x000007FEF594D000-memory.dmp

Filesize
9.6MB

Download
memory/2980-5-0x000007FEF4FB0000-0x000007FEF594D000-memory.dmp

Filesize
9.6MB

Download
memory/2980-6-0x000007FEF526E000-0x000007FEF526F000-memory.dmp

Filesize
4KB

Download