189b6d46681b262df34784da5c4d640f33f7c517aa4666c9213a5c3e83fb7189

Analysis

max time kernel
168s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:46

Target

189b6d46681b262df34784da5c4d640f33f7c517aa4666c9213a5c3e83fb7189.exe
Size

271KB
MD5

8b5e432e6bdaa25dc087d19aa168b1bd
SHA1

6acec8dc0dbca2264d8f8021eec816faf5e5b6d4
SHA256

189b6d46681b262df34784da5c4d640f33f7c517aa4666c9213a5c3e83fb7189
SHA512

b7ba7c1ce08252f06f154914d5facae4e32d5199e3bd4c74137875be9d8a758609b3c419bbfa647699393886f3e68a5a0b4358d2bbb0fbc394e04b18556283fd
SSDEEP

6144:KsvF0/neSm6n2FrDvR2gL224cizU3cGyxPiVbEuNslbDVOP+5VT:KsZSTnSvR2ga1N43cFkCsslfrVT

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

dw20.exe

pid process

1632 dw20.exe

pid	process
1632	dw20.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

189b6d46681b262df34784da5c4d640f33f7c517aa4666c9213a5c3e83fb7189.exe

description	pid	process	target process
PID 956 wrote to memory of 1632	956	189b6d46681b262df34784da5c4d640f33f7c517aa4666c9213a5c3e83fb7189.exe	dw20.exe
PID 956 wrote to memory of 1632	956	189b6d46681b262df34784da5c4d640f33f7c517aa4666c9213a5c3e83fb7189.exe	dw20.exe
PID 956 wrote to memory of 1632	956	189b6d46681b262df34784da5c4d640f33f7c517aa4666c9213a5c3e83fb7189.exe	dw20.exe
PID 956 wrote to memory of 1632	956	189b6d46681b262df34784da5c4d640f33f7c517aa4666c9213a5c3e83fb7189.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\189b6d46681b262df34784da5c4d640f33f7c517aa4666c9213a5c3e83fb7189.exe
"C:\Users\Admin\AppData\Local\Temp\189b6d46681b262df34784da5c4d640f33f7c517aa4666c9213a5c3e83fb7189.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:956

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 408
2⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1632

memory/956-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/956-56-0x0000000074300000-0x00000000748AB000-memory.dmp

Filesize
5.7MB

Download
memory/956-58-0x0000000074300000-0x00000000748AB000-memory.dmp

Filesize
5.7MB

Download
memory/1632-55-0x0000000000000000-mapping.dmp

Download