990bcaf138c29483b5573089b243cc6f4751ccd521148297130e3e36aa70e9f8

Analysis

max time kernel
425s
max time network
428s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-09-2022 14:44

Target

bin/CSharpRFIDDemo.vshost.exe
Size

14KB
MD5

22cbea70ef58692af7d18aa9c498f1b0
SHA1

3837a1d1cd47bedaf061626c12833a7581d1a276
SHA256

3baf862dfba28471178565c43e7898b37aadd4f1681393d43fa46d965db70c99
SHA512

52ba70f9651c7a2bbfde40b17f6d435ab990f510363a3f12b466273cf007c3c07a60ee64f2afb068be7be51d2e68f18072d05b87752dd73343816241324d7456
SSDEEP

192:a7LExBp/WrnWco6oEQKPnEt2yt8mGafdjIafdjShjjpC:wST/WrnWJnELKt8HafdjIafdjcj9C

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

dw20.exe

pid process

880 dw20.exe

pid	process
880	dw20.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

CSharpRFIDDemo.vshost.exe

description	pid	process	target process
PID 288 wrote to memory of 880	288	CSharpRFIDDemo.vshost.exe	dw20.exe
PID 288 wrote to memory of 880	288	CSharpRFIDDemo.vshost.exe	dw20.exe
PID 288 wrote to memory of 880	288	CSharpRFIDDemo.vshost.exe	dw20.exe
PID 288 wrote to memory of 880	288	CSharpRFIDDemo.vshost.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\bin\CSharpRFIDDemo.vshost.exe
"C:\Users\Admin\AppData\Local\Temp\bin\CSharpRFIDDemo.vshost.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:288

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 960
2⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:880

memory/288-54-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download
memory/288-55-0x0000000074780000-0x0000000074D2B000-memory.dmp

Filesize
5.7MB

Download
memory/288-58-0x0000000074780000-0x0000000074D2B000-memory.dmp

Filesize
5.7MB

Download
memory/880-56-0x0000000000000000-mapping.dmp

Download