a77c61e86bc69fdc909560bb7a0fa1dd61ee6c86afceb9ea17462a97e7114ab0

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 11:39

Target

a77c61e86bc69fdc909560bb7a0fa1dd61ee6c86afceb9ea17462a97e7114ab0.exe
Size

5.0MB
MD5

198f27f5ab972bfd99e89802e40d6ba7
SHA1

e8b40f35af4d5bb24d73faa5a4babb86191b5310
SHA256

a77c61e86bc69fdc909560bb7a0fa1dd61ee6c86afceb9ea17462a97e7114ab0
SHA512

95a5b47ee77a0a51f6ba2a642fee876ce11dcbace4ffc3f4b8dbeda21e45873659ea8306ae84a8329288ac0850db8b5ea8cd8e22aa8f05f8905c3e656a20455b
SSDEEP

98304:aE8msmmmnWH92McSBfvSG/hux95f1nsK0HYHHHAzoqu:aJd2M5BfJqf1n70toP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 2444	1548	a77c61e86bc69fdc909560bb7a0fa1dd61ee6c86afceb9ea17462a97e7114ab0.exe	28
PID 1548 wrote to memory of 2444	1548	a77c61e86bc69fdc909560bb7a0fa1dd61ee6c86afceb9ea17462a97e7114ab0.exe	28
PID 1548 wrote to memory of 2444	1548	a77c61e86bc69fdc909560bb7a0fa1dd61ee6c86afceb9ea17462a97e7114ab0.exe	28

C:\Users\Admin\AppData\Local\Temp\a77c61e86bc69fdc909560bb7a0fa1dd61ee6c86afceb9ea17462a97e7114ab0.exe
"C:\Users\Admin\AppData\Local\Temp\a77c61e86bc69fdc909560bb7a0fa1dd61ee6c86afceb9ea17462a97e7114ab0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 496
  2⤵
  PID:2444

memory/1548-0-0x000007FEF646E000-0x000007FEF646F000-memory.dmp

Filesize
4KB

Download
memory/1548-1-0x000007FEF61B0000-0x000007FEF6B4D000-memory.dmp

Filesize
9.6MB

Download
memory/1548-2-0x000007FEF61B0000-0x000007FEF6B4D000-memory.dmp

Filesize
9.6MB

Download
memory/1548-3-0x000000001B280000-0x000000001B6AE000-memory.dmp

Filesize
4.2MB

Download
memory/1548-79-0x000007FEF646E000-0x000007FEF646F000-memory.dmp

Filesize
4KB

Download
memory/1548-80-0x000007FEF61B0000-0x000007FEF6B4D000-memory.dmp

Filesize
9.6MB

Download
memory/2444-78-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download