6172ae2f772bf4eb99d2b6a7e30096d0286f63bef987e77f6952692d90553490

Analysis

max time kernel
247s
max time network
335s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 17:03

Target

6172ae2f772bf4eb99d2b6a7e30096d0286f63bef987e77f6952692d90553490.exe
Size

156KB
MD5

58c4e577ef722121eca7c8f4084a1b8a
SHA1

4891a6a1cd9de61481c428153ac7943d0013c4e2
SHA256

6172ae2f772bf4eb99d2b6a7e30096d0286f63bef987e77f6952692d90553490
SHA512

f1d25ab9a943ef53f80a21a6b2141ea80c609ae53b4c31fd6389202a0f1ce9d8c3d630a76b8528421cd9cde1a7319c0c534348fbdc48fec9284989edbdeb8d27
SSDEEP

3072:EFiJf+FAd/fb75NUmfYQp/IRLsqd1pIecTH:EEJfAAZT7wgYDs4pG

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

dw20.exe

pid process

1020 dw20.exe

pid	process
1020	dw20.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6172ae2f772bf4eb99d2b6a7e30096d0286f63bef987e77f6952692d90553490.exe

description	pid	process	target process
PID 1324 wrote to memory of 1020	1324	6172ae2f772bf4eb99d2b6a7e30096d0286f63bef987e77f6952692d90553490.exe	dw20.exe
PID 1324 wrote to memory of 1020	1324	6172ae2f772bf4eb99d2b6a7e30096d0286f63bef987e77f6952692d90553490.exe	dw20.exe
PID 1324 wrote to memory of 1020	1324	6172ae2f772bf4eb99d2b6a7e30096d0286f63bef987e77f6952692d90553490.exe	dw20.exe
PID 1324 wrote to memory of 1020	1324	6172ae2f772bf4eb99d2b6a7e30096d0286f63bef987e77f6952692d90553490.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\6172ae2f772bf4eb99d2b6a7e30096d0286f63bef987e77f6952692d90553490.exe
"C:\Users\Admin\AppData\Local\Temp\6172ae2f772bf4eb99d2b6a7e30096d0286f63bef987e77f6952692d90553490.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1324

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 396
2⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1020

memory/1020-55-0x0000000000000000-mapping.dmp

Download
memory/1324-54-0x00000000757C1000-0x00000000757C3000-memory.dmp

Filesize
8KB

Download
memory/1324-57-0x00000000747E0000-0x0000000074D8B000-memory.dmp

Filesize
5.7MB

Download
memory/1324-58-0x00000000747E0000-0x0000000074D8B000-memory.dmp

Filesize
5.7MB

Download