4ef702a13b87f44dcdc149ba50fc0a334192c57018ccc1d846d19d8c4646fc93

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 01:29

Target

4ef702a13b87f44dcdc149ba50fc0a334192c57018ccc1d846d19d8c4646fc93.exe
Size

239KB
MD5

58a5c8b03f4f14c3fdfeb1e73cf72ac8
SHA1

fd35c9c55012cc6871812cc985dbdb436ccb0fac
SHA256

4ef702a13b87f44dcdc149ba50fc0a334192c57018ccc1d846d19d8c4646fc93
SHA512

3e18a44e6c113d8f7c975bae6b57137524c15ebe802462c8be8da94b917341fdb4654aa51d9f5846978e827ace1ed521b1da6a33f1200c203e4ac1f9e4cec639
SSDEEP

3072:hsXRmUIMitiMQose27vc+Eld+xZp2vPRL1tT06zJoxAWBcKpSP//dwR1l9B4hT5:GR5IuMQoseGk7RZBGxAycKpSPX2pU3

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 1908	1540	4ef702a13b87f44dcdc149ba50fc0a334192c57018ccc1d846d19d8c4646fc93.exe	30
PID 1540 wrote to memory of 1908	1540	4ef702a13b87f44dcdc149ba50fc0a334192c57018ccc1d846d19d8c4646fc93.exe	30
PID 1540 wrote to memory of 1908	1540	4ef702a13b87f44dcdc149ba50fc0a334192c57018ccc1d846d19d8c4646fc93.exe	30

C:\Users\Admin\AppData\Local\Temp\4ef702a13b87f44dcdc149ba50fc0a334192c57018ccc1d846d19d8c4646fc93.exe
"C:\Users\Admin\AppData\Local\Temp\4ef702a13b87f44dcdc149ba50fc0a334192c57018ccc1d846d19d8c4646fc93.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 460
  2⤵
  PID:1908

memory/1540-0-0x000007FEF538E000-0x000007FEF538F000-memory.dmp

Filesize
4KB

Download
memory/1540-2-0x000007FEF50D0000-0x000007FEF5A6D000-memory.dmp

Filesize
9.6MB

Download
memory/1540-1-0x000007FEF50D0000-0x000007FEF5A6D000-memory.dmp

Filesize
9.6MB

Download
memory/1540-3-0x000007FEF50D0000-0x000007FEF5A6D000-memory.dmp

Filesize
9.6MB

Download
memory/1540-5-0x000007FEF538E000-0x000007FEF538F000-memory.dmp

Filesize
4KB

Download
memory/1540-6-0x000007FEF50D0000-0x000007FEF5A6D000-memory.dmp

Filesize
9.6MB

Download
memory/1908-4-0x00000000004F0000-0x00000000004F1000-memory.dmp

Filesize
4KB

Download