4ef702a13b87f44dcdc149ba50fc0a334192c57018ccc1d846d19d8c4646fc93

Analysis

max time kernel
21s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-09-2024 19:16

Target

4ef702a13b87f44dcdc149ba50fc0a334192c57018ccc1d846d19d8c4646fc93.exe
Size

239KB
MD5

58a5c8b03f4f14c3fdfeb1e73cf72ac8
SHA1

fd35c9c55012cc6871812cc985dbdb436ccb0fac
SHA256

4ef702a13b87f44dcdc149ba50fc0a334192c57018ccc1d846d19d8c4646fc93
SHA512

3e18a44e6c113d8f7c975bae6b57137524c15ebe802462c8be8da94b917341fdb4654aa51d9f5846978e827ace1ed521b1da6a33f1200c203e4ac1f9e4cec639
SSDEEP

3072:hsXRmUIMitiMQose27vc+Eld+xZp2vPRL1tT06zJoxAWBcKpSP//dwR1l9B4hT5:GR5IuMQoseGk7RZBGxAycKpSPX2pU3

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2308	2932	4ef702a13b87f44dcdc149ba50fc0a334192c57018ccc1d846d19d8c4646fc93.exe	30
PID 2932 wrote to memory of 2308	2932	4ef702a13b87f44dcdc149ba50fc0a334192c57018ccc1d846d19d8c4646fc93.exe	30
PID 2932 wrote to memory of 2308	2932	4ef702a13b87f44dcdc149ba50fc0a334192c57018ccc1d846d19d8c4646fc93.exe	30

C:\Users\Admin\AppData\Local\Temp\4ef702a13b87f44dcdc149ba50fc0a334192c57018ccc1d846d19d8c4646fc93.exe
"C:\Users\Admin\AppData\Local\Temp\4ef702a13b87f44dcdc149ba50fc0a334192c57018ccc1d846d19d8c4646fc93.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 456
  2⤵
  PID:2308

memory/2308-4-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2932-0-0x000007FEF5AFE000-0x000007FEF5AFF000-memory.dmp

Filesize
4KB

Download
memory/2932-1-0x000007FEF5840000-0x000007FEF61DD000-memory.dmp

Filesize
9.6MB

Download
memory/2932-2-0x000007FEF5840000-0x000007FEF61DD000-memory.dmp

Filesize
9.6MB

Download
memory/2932-3-0x000007FEF5840000-0x000007FEF61DD000-memory.dmp

Filesize
9.6MB

Download
memory/2932-5-0x000007FEF5AFE000-0x000007FEF5AFF000-memory.dmp

Filesize
4KB

Download
memory/2932-6-0x000007FEF5840000-0x000007FEF61DD000-memory.dmp

Filesize
9.6MB

Download