9654548471ae441c9370743867d6cd9ff7096f32df6d46b6346c49b65b33c50e

Analysis

max time kernel
245s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 21:13

Target

9654548471ae441c9370743867d6cd9ff7096f32df6d46b6346c49b65b33c50e.exe
Size

27KB
MD5

35159887964d61456e2ebc9955d1767d
SHA1

a7821cdcd19af9c1104481039c18ca626fa62987
SHA256

9654548471ae441c9370743867d6cd9ff7096f32df6d46b6346c49b65b33c50e
SHA512

6b41300331f93450ba632379725f00bf50cc965a9c2125da32c95517955dba1edfa8f9119455f80aecf95b9b54bb19360bebbf6b8840f872d01b09b05f620b49
SSDEEP

384:542FnO9W+Im2cjUcMw6ba6ZH51SzdcjvRr9rqqihgcHDcm5HbDkeHeXRjSXC7rwN:54qEJhucj8nZHWK7PZcjZ/keHqjIor

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1708	dw20.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 564 wrote to memory of 1708	564	9654548471ae441c9370743867d6cd9ff7096f32df6d46b6346c49b65b33c50e.exe	28
PID 564 wrote to memory of 1708	564	9654548471ae441c9370743867d6cd9ff7096f32df6d46b6346c49b65b33c50e.exe	28
PID 564 wrote to memory of 1708	564	9654548471ae441c9370743867d6cd9ff7096f32df6d46b6346c49b65b33c50e.exe	28
PID 564 wrote to memory of 1708	564	9654548471ae441c9370743867d6cd9ff7096f32df6d46b6346c49b65b33c50e.exe	28

C:\Users\Admin\AppData\Local\Temp\9654548471ae441c9370743867d6cd9ff7096f32df6d46b6346c49b65b33c50e.exe
"C:\Users\Admin\AppData\Local\Temp\9654548471ae441c9370743867d6cd9ff7096f32df6d46b6346c49b65b33c50e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:564
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 420
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1708

memory/564-54-0x0000000076D71000-0x0000000076D73000-memory.dmp

Filesize
8KB

Download
memory/564-57-0x0000000074D50000-0x00000000752FB000-memory.dmp

Filesize
5.7MB

Download