c4a2a52efcef62609d2a6924d7545477e712c3944dcead4a99e9e202ce2f3037

Analysis

max time kernel
166s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 19:35

Target

c4a2a52efcef62609d2a6924d7545477e712c3944dcead4a99e9e202ce2f3037.exe
Size

395KB
MD5

f41f49380b412c26bb01cf00fe87f3ce
SHA1

dfc7ff7acceb9a01e116ed8eae24e06abc0c7428
SHA256

c4a2a52efcef62609d2a6924d7545477e712c3944dcead4a99e9e202ce2f3037
SHA512

879d2599ef6d70099fa5fbaec383113f9eb67315480e0df7ca0d57aba2a0624d3b238774ef732c64e382f12b938913812d79b9c8b7cdcc89d6e0b2b35ed1f91b
SSDEEP

12288:Xy+Jhzj42HuquXYeGiGkFLalBmR5zO3/ec:7eGZkWCM3v

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

dw20.exe

pid process

1524 dw20.exe

pid	process
1524	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c4a2a52efcef62609d2a6924d7545477e712c3944dcead4a99e9e202ce2f3037.exe

description	pid	process	target process
PID 2012 wrote to memory of 1524	2012	c4a2a52efcef62609d2a6924d7545477e712c3944dcead4a99e9e202ce2f3037.exe	dw20.exe
PID 2012 wrote to memory of 1524	2012	c4a2a52efcef62609d2a6924d7545477e712c3944dcead4a99e9e202ce2f3037.exe	dw20.exe
PID 2012 wrote to memory of 1524	2012	c4a2a52efcef62609d2a6924d7545477e712c3944dcead4a99e9e202ce2f3037.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\c4a2a52efcef62609d2a6924d7545477e712c3944dcead4a99e9e202ce2f3037.exe
"C:\Users\Admin\AppData\Local\Temp\c4a2a52efcef62609d2a6924d7545477e712c3944dcead4a99e9e202ce2f3037.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
dw20.exe -x -s 408
2⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1524

memory/1524-55-0x0000000000000000-mapping.dmp

Download
memory/1524-56-0x000007FEFC071000-0x000007FEFC073000-memory.dmp

Filesize
8KB

Download
memory/2012-54-0x000007FEF3CF0000-0x000007FEF4713000-memory.dmp

Filesize
10.1MB

Download