280268db673f66dc31e54d86de101cf8b5d52c583a9282d9c7ccb4475612a8e0

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 13:10

Target

4e180437ef807b6ded234ad54f506d0cff518c980a055013871529b5905a46a9.exe
Size

71KB
MD5

7d09bbc0aee91d29b3e62aa7889d75ac
SHA1

dcc48feec76915615fca1db6e2e726543fba9566
SHA256

4e180437ef807b6ded234ad54f506d0cff518c980a055013871529b5905a46a9
SHA512

3f476f40f9a17919946df05bca46d0169531fd32982cc7c62ec685aef680c2fe064361da928fb174274c88f25b64db75f9c996e271e5b3a0836aa4101649a275
SSDEEP

192:YKA9x8uHsLXl0Hjo7WLom8YHwOrDU0U4cbHaF55n3nN7a:YKA9WuwXl0YZm8eDr40/cuF73Za

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

4e180437ef807b6ded234ad54f506d0cff518c980a055013871529b5905a46a9.exe

description	pid	Process	procid_target
PID 2076 wrote to memory of 3036	2076	4e180437ef807b6ded234ad54f506d0cff518c980a055013871529b5905a46a9.exe	31
PID 2076 wrote to memory of 3036	2076	4e180437ef807b6ded234ad54f506d0cff518c980a055013871529b5905a46a9.exe	31
PID 2076 wrote to memory of 3036	2076	4e180437ef807b6ded234ad54f506d0cff518c980a055013871529b5905a46a9.exe	31

C:\Users\Admin\AppData\Local\Temp\4e180437ef807b6ded234ad54f506d0cff518c980a055013871529b5905a46a9.exe
"C:\Users\Admin\AppData\Local\Temp\4e180437ef807b6ded234ad54f506d0cff518c980a055013871529b5905a46a9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 764
  2⤵
  PID:3036

memory/2076-0-0x000007FEF53FE000-0x000007FEF53FF000-memory.dmp

Filesize
4KB

Download
memory/2076-1-0x000007FEF5140000-0x000007FEF5ADD000-memory.dmp

Filesize
9.6MB

Download
memory/2076-2-0x000007FEF5140000-0x000007FEF5ADD000-memory.dmp

Filesize
9.6MB

Download
memory/2076-3-0x000007FEF53FE000-0x000007FEF53FF000-memory.dmp

Filesize
4KB

Download
memory/2076-5-0x000007FEF5140000-0x000007FEF5ADD000-memory.dmp

Filesize
9.6MB

Download
memory/3036-4-0x0000000000470000-0x0000000000471000-memory.dmp

Filesize
4KB

Download