624220121cdd939eced6c27156777b33e0cc76151475276515b2060a084437be

Analysis

max time kernel
227s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 15:56

Target

624220121cdd939eced6c27156777b33e0cc76151475276515b2060a084437be.exe
Size

302KB
MD5

c278895900bd5f86be4c54eedede0df5
SHA1

723f0ad82feaa2f138251d3e9c982f042a4c6bf5
SHA256

624220121cdd939eced6c27156777b33e0cc76151475276515b2060a084437be
SHA512

52cd6f4d24f160e5418ecbc38296db47ffd9ef4ffa4df4127e5942d67d96d7909ccfe98069bbedafe87107ada713e1cae1c8c224af5d02610befb9751e5776ce
SSDEEP

6144:BT7qYjEAYPGHjr9OT6bzweyEe+brPcXA:BvqYY9PGHjxOTVnpm

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1716	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 672 wrote to memory of 1716	672	624220121cdd939eced6c27156777b33e0cc76151475276515b2060a084437be.exe	28
PID 672 wrote to memory of 1716	672	624220121cdd939eced6c27156777b33e0cc76151475276515b2060a084437be.exe	28
PID 672 wrote to memory of 1716	672	624220121cdd939eced6c27156777b33e0cc76151475276515b2060a084437be.exe	28

C:\Users\Admin\AppData\Local\Temp\624220121cdd939eced6c27156777b33e0cc76151475276515b2060a084437be.exe
"C:\Users\Admin\AppData\Local\Temp\624220121cdd939eced6c27156777b33e0cc76151475276515b2060a084437be.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:672
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 372
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1716

memory/672-54-0x000007FEF4120000-0x000007FEF4B43000-memory.dmp

Filesize
10.1MB

Download
memory/1716-56-0x000007FEFC461000-0x000007FEFC463000-memory.dmp

Filesize
8KB

Download