c972c525d0d435e3ea4e1ac892f79f204ece9ee9c3499399995e46c7c687cf98

Analysis

max time kernel
133s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 17:47

Target

c972c525d0d435e3ea4e1ac892f79f204ece9ee9c3499399995e46c7c687cf98.exe
Size

302KB
MD5

3d98d6cc9a802f2dd157ab2449d8758e
SHA1

cfc90e3f0e148be4aa0b6ec80dc1e18d22d8e26b
SHA256

c972c525d0d435e3ea4e1ac892f79f204ece9ee9c3499399995e46c7c687cf98
SHA512

eb37fb38e25ff3da83aa34be88a60da116a2842e13be846e66e18cf5348626e8bed0c2e1c019cd26fa2ff828ef317df457b6b11cc44ff843386f688a0ef57e0a
SSDEEP

6144:GGuYgG4A74kAOMKdzYEADAa2Dq1vRWHC1d8hEypi:uDA75vb3x2+zhEyE

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1324	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 1324	1232	c972c525d0d435e3ea4e1ac892f79f204ece9ee9c3499399995e46c7c687cf98.exe	28
PID 1232 wrote to memory of 1324	1232	c972c525d0d435e3ea4e1ac892f79f204ece9ee9c3499399995e46c7c687cf98.exe	28
PID 1232 wrote to memory of 1324	1232	c972c525d0d435e3ea4e1ac892f79f204ece9ee9c3499399995e46c7c687cf98.exe	28

C:\Users\Admin\AppData\Local\Temp\c972c525d0d435e3ea4e1ac892f79f204ece9ee9c3499399995e46c7c687cf98.exe
"C:\Users\Admin\AppData\Local\Temp\c972c525d0d435e3ea4e1ac892f79f204ece9ee9c3499399995e46c7c687cf98.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 388
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1324

memory/1232-54-0x000007FEF3C50000-0x000007FEF4673000-memory.dmp

Filesize
10.1MB

Download
memory/1324-56-0x000007FEFBF91000-0x000007FEFBF93000-memory.dmp

Filesize
8KB

Download