4eeb5d8830e378c5c351d8ea1f8b370364e6ab530573e1f609d8d459e3f23b1a

Analysis

max time kernel
117s
max time network
133s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 18:55

Target

Lime-Worm-0.5.8D\Stub\Stub.exe
Size

23KB
MD5

1caf905bb41f2ad4276434e0ffc98e6d
SHA1

3c3a8365d35e4ca5afd31cbe78730878396a4dfd
SHA256

140fe71dd70d34732730dd15d685510f3f1c0e46d5d0ff19e93b6eac183ad13e
SHA512

23ada7ee3c77853915ea33f03e75e16a717179089539854d7ac25d4d757a69b18f3359530a0733f78fb0440f9be0400a0c0c6b0a3f3163cfb78c10f14fce9076
SSDEEP

384:J+phBgqtdAj8g5Q6XUb1GIcopFK47v+vcxhKNjmJj1Qro0wdH1FM:JcArzXUb9NRqVNaU01G

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Stub.exe

description pid process target process

PID 2432 wrote to memory of 2596 2432 Stub.exe dw20.exe
PID 2432 wrote to memory of 2596 2432 Stub.exe dw20.exe
PID 2432 wrote to memory of 2596 2432 Stub.exe dw20.exe

description	pid	process	target process
PID 2432 wrote to memory of 2596	2432	Stub.exe	dw20.exe
PID 2432 wrote to memory of 2596	2432	Stub.exe	dw20.exe
PID 2432 wrote to memory of 2596	2432	Stub.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\Lime-Worm-0.5.8D\Stub\Stub.exe
"C:\Users\Admin\AppData\Local\Temp\Lime-Worm-0.5.8D\Stub\Stub.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2432

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
dw20.exe -x -s 396
2⤵
PID:2596

memory/2432-0-0x000007FEF5B2E000-0x000007FEF5B2F000-memory.dmp

Filesize
4KB

Download
memory/2432-3-0x000007FEF5B2E000-0x000007FEF5B2F000-memory.dmp

Filesize
4KB

Download
memory/2432-1-0x000007FEF5870000-0x000007FEF620D000-memory.dmp

Filesize
9.6MB

Download
memory/2432-4-0x000007FEF5870000-0x000007FEF620D000-memory.dmp

Filesize
9.6MB

Download
memory/2596-2-0x0000000000460000-0x0000000000461000-memory.dmp

Filesize
4KB

Download
memory/2596-5-0x0000000000460000-0x0000000000461000-memory.dmp

Filesize
4KB

Download