bf2ef38252bec7a94343981f946655962ec1902f9e19c601d5d7e17a2ff203cb

Analysis

max time kernel
133s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23/11/2022, 19:47

Target

bf2ef38252bec7a94343981f946655962ec1902f9e19c601d5d7e17a2ff203cb.exe
Size

160KB
MD5

06eea8aa63d1d493c82f0ad6ac205735
SHA1

3b18210d7a95ccf7a87457777cd189c6d62e85ff
SHA256

bf2ef38252bec7a94343981f946655962ec1902f9e19c601d5d7e17a2ff203cb
SHA512

25fe20decac96957eeaeb8163486dd77224bbb96d09452c780024c0e0229fa2a62f2fc833f56224c17b52f31e2821e609f81c61303a49f070d134ddd8a26d239
SSDEEP

3072:snDV6Qz11WQFvYGnJd6KpZV3uTN9WU/G9B32w590KqRbmzALbvl6:uQQaQFvYGJd6KpZV3uTN9WU/G9BGw59W

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1400	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 1400	1416	bf2ef38252bec7a94343981f946655962ec1902f9e19c601d5d7e17a2ff203cb.exe	28
PID 1416 wrote to memory of 1400	1416	bf2ef38252bec7a94343981f946655962ec1902f9e19c601d5d7e17a2ff203cb.exe	28
PID 1416 wrote to memory of 1400	1416	bf2ef38252bec7a94343981f946655962ec1902f9e19c601d5d7e17a2ff203cb.exe	28

C:\Users\Admin\AppData\Local\Temp\bf2ef38252bec7a94343981f946655962ec1902f9e19c601d5d7e17a2ff203cb.exe
"C:\Users\Admin\AppData\Local\Temp\bf2ef38252bec7a94343981f946655962ec1902f9e19c601d5d7e17a2ff203cb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 392
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1400

memory/1400-57-0x000007FEFBE41000-0x000007FEFBE43000-memory.dmp

Filesize
8KB

Download
memory/1416-54-0x000007FEF3AE0000-0x000007FEF4503000-memory.dmp

Filesize
10.1MB

Download
memory/1416-55-0x000007FEF2A40000-0x000007FEF3AD6000-memory.dmp

Filesize
16.6MB

Download