c4b8441797a8ea32ae2605b576b86db2ad39cfba34014ddc3aadc5eab8d5195b

Analysis

max time kernel
172s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 08:15

Target

CADChart/HydroCADChart/obj/Debug/HydroCADChart.exe
Size

2.6MB
MD5

d8f78d2290a63ff8213d5b1cf0dd7441
SHA1

acf49098bd73b018e9f92564423a6876a5d754d1
SHA256

9d6bbb7a945a0a04f4313210afe579026b8b1705853c62114f47266031db43f2
SHA512

e5c68f8ade7ea3a02564240f3724f7b7eb4721330d40a482a81e85185b9c11b4f2e6870a000b6a95cc2df0931ecb494c5f59527f7d9ecc98e1e1f209e173d022
SSDEEP

24576:kvfP4TZAPGv4NShfCSErR8wuGNwCsS2aryvfP4TZAPGv4NShfCSErR8wuGNwCsSz:QQjv4ECS40KeQjv4ECS40K

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2040	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 2040	1508	HydroCADChart.exe	28
PID 1508 wrote to memory of 2040	1508	HydroCADChart.exe	28
PID 1508 wrote to memory of 2040	1508	HydroCADChart.exe	28

C:\Users\Admin\AppData\Local\Temp\CADChart\HydroCADChart\obj\Debug\HydroCADChart.exe
"C:\Users\Admin\AppData\Local\Temp\CADChart\HydroCADChart\obj\Debug\HydroCADChart.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 388
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2040

memory/1508-54-0x000007FEF3840000-0x000007FEF4263000-memory.dmp

Filesize
10.1MB

Download
memory/1508-55-0x000007FEEE920000-0x000007FEEF9B6000-memory.dmp

Filesize
16.6MB

Download
memory/2040-57-0x000007FEFBDB1000-0x000007FEFBDB3000-memory.dmp

Filesize
8KB

Download