e058ef72836a6b4fd62a4c91e2c0c5f7c1627268b53bbc1bcd95143858888076

Analysis

max time kernel
231s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 16:43

Target

e058ef72836a6b4fd62a4c91e2c0c5f7c1627268b53bbc1bcd95143858888076.exe
Size

15KB
MD5

f7b15ea4a6de181fe8d1895a4d16b4a8
SHA1

0b335dc5cb5c1959bc9ca6cd87fcd7599a91c83e
SHA256

e058ef72836a6b4fd62a4c91e2c0c5f7c1627268b53bbc1bcd95143858888076
SHA512

fc040edbbf091aaa3ca035cbe55c95233639503276914861c891d2fc4972480d4a4025476af19420ea0d189bb4ade866545a1c8a0cef8058652a6746dba7bbe0
SSDEEP

384:LJ+DJSAmaSEDiGMHZQgyyTQt4lgOQ7hsoddCzYcCe:LJ4JnmaSEDb5t4lXtzYcCe

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
920	dw20.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	472	e058ef72836a6b4fd62a4c91e2c0c5f7c1627268b53bbc1bcd95143858888076.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 472 wrote to memory of 268	472	e058ef72836a6b4fd62a4c91e2c0c5f7c1627268b53bbc1bcd95143858888076.exe	28
PID 472 wrote to memory of 268	472	e058ef72836a6b4fd62a4c91e2c0c5f7c1627268b53bbc1bcd95143858888076.exe	28
PID 472 wrote to memory of 268	472	e058ef72836a6b4fd62a4c91e2c0c5f7c1627268b53bbc1bcd95143858888076.exe	28
PID 472 wrote to memory of 1172	472	e058ef72836a6b4fd62a4c91e2c0c5f7c1627268b53bbc1bcd95143858888076.exe	29
PID 472 wrote to memory of 1172	472	e058ef72836a6b4fd62a4c91e2c0c5f7c1627268b53bbc1bcd95143858888076.exe	29
PID 472 wrote to memory of 1172	472	e058ef72836a6b4fd62a4c91e2c0c5f7c1627268b53bbc1bcd95143858888076.exe	29
PID 472 wrote to memory of 1172	472	e058ef72836a6b4fd62a4c91e2c0c5f7c1627268b53bbc1bcd95143858888076.exe	29
PID 472 wrote to memory of 920	472	e058ef72836a6b4fd62a4c91e2c0c5f7c1627268b53bbc1bcd95143858888076.exe	30
PID 472 wrote to memory of 920	472	e058ef72836a6b4fd62a4c91e2c0c5f7c1627268b53bbc1bcd95143858888076.exe	30
PID 472 wrote to memory of 920	472	e058ef72836a6b4fd62a4c91e2c0c5f7c1627268b53bbc1bcd95143858888076.exe	30

C:\Users\Admin\AppData\Local\Temp\e058ef72836a6b4fd62a4c91e2c0c5f7c1627268b53bbc1bcd95143858888076.exe
"C:\Users\Admin\AppData\Local\Temp\e058ef72836a6b4fd62a4c91e2c0c5f7c1627268b53bbc1bcd95143858888076.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:472
- C:\Users\Admin\AppData\Local\Temp\e058ef72836a6b4fd62a4c91e2c0c5f7c1627268b53bbc1bcd95143858888076.exe
  C:\Users\Admin\AppData\Local\Temp\e058ef72836a6b4fd62a4c91e2c0c5f7c1627268b53bbc1bcd95143858888076.exe
  2⤵
  PID:268
- C:\Users\Admin\AppData\Local\Temp\e058ef72836a6b4fd62a4c91e2c0c5f7c1627268b53bbc1bcd95143858888076.exe
  C:\Users\Admin\AppData\Local\Temp\e058ef72836a6b4fd62a4c91e2c0c5f7c1627268b53bbc1bcd95143858888076.exe
  2⤵
  PID:1172
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 500
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:920

memory/472-54-0x000007FEF3BC0000-0x000007FEF45E3000-memory.dmp

Filesize
10.1MB

Download
memory/920-57-0x000007FEFBEE1000-0x000007FEFBEE3000-memory.dmp

Filesize
8KB

Download
memory/1172-55-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download