57ea0fcab12d9dd2ac739dab7662c1cc94402a86ee898838a95ef03eb7e2557f

Analysis

max time kernel
133s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 07:31

Target

0x00070000000126ff-73.exe
Size

217KB
MD5

2346a0361ae3c517d6f0d2df582297f6
SHA1

3828ea4c1eced88f09cc817cdc150101db9a8599
SHA256

57ea0fcab12d9dd2ac739dab7662c1cc94402a86ee898838a95ef03eb7e2557f
SHA512

81b9376a2c315362deb8315229334c999aed92636d5bc47324315be18b63edbcc792d270a04f709ead5b047dee55ba7237c2349aa502bb3bb63dbba2379e1494
SSDEEP

3072:9nyjGla89N/Gbaq6ZYmvWAyaHmUKrTdArHH2PxdPErn+OKtQEFFjizcyO:9Cs3/acOoaTUITdWHQdMJoPjacy

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

dw20.exe

pid process

2020 dw20.exe

pid	process
2020	dw20.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0x00070000000126ff-73.exe

description	pid	process	target process
PID 1924 wrote to memory of 2020	1924	0x00070000000126ff-73.exe	dw20.exe
PID 1924 wrote to memory of 2020	1924	0x00070000000126ff-73.exe	dw20.exe
PID 1924 wrote to memory of 2020	1924	0x00070000000126ff-73.exe	dw20.exe
PID 1924 wrote to memory of 2020	1924	0x00070000000126ff-73.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\0x00070000000126ff-73.exe
"C:\Users\Admin\AppData\Local\Temp\0x00070000000126ff-73.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1924

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 424
2⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2020

memory/1924-54-0x0000000075EC1000-0x0000000075EC3000-memory.dmp

Filesize
8KB

Download
memory/1924-57-0x0000000074EA0000-0x000000007544B000-memory.dmp

Filesize
5.7MB

Download
memory/1924-58-0x0000000074EA0000-0x000000007544B000-memory.dmp

Filesize
5.7MB

Download
memory/2020-55-0x0000000000000000-mapping.dmp

Download