32f92c618b7d5da544b9a21e9fb4529bb4c863d5b24e577bbf8b49dfe42a2eec

Analysis

max time kernel
234s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 18:49

Target

32f92c618b7d5da544b9a21e9fb4529bb4c863d5b24e577bbf8b49dfe42a2eec.exe
Size

166KB
MD5

c74da8a3241872fa12afdd488a4f7d2e
SHA1

d220ce49112e985ffc784cf4e6324140756786bd
SHA256

32f92c618b7d5da544b9a21e9fb4529bb4c863d5b24e577bbf8b49dfe42a2eec
SHA512

833f294e0b388eb482e37d9610408aa53f5f71049c1ce591b0d00caf46b1d48eb53ac006467094d2451752e3458139befe60705d7f099c9b4f61a3d71fd3d42c
SSDEEP

3072:Q78TC5M81hK+zE9wS9CTSL5mRNA35ObcVt90n2hIR5YC9pH312/P/Q:Q6oD189Ma34bxcuX12/

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
268	dw20.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 268	1924	32f92c618b7d5da544b9a21e9fb4529bb4c863d5b24e577bbf8b49dfe42a2eec.exe	28
PID 1924 wrote to memory of 268	1924	32f92c618b7d5da544b9a21e9fb4529bb4c863d5b24e577bbf8b49dfe42a2eec.exe	28
PID 1924 wrote to memory of 268	1924	32f92c618b7d5da544b9a21e9fb4529bb4c863d5b24e577bbf8b49dfe42a2eec.exe	28
PID 1924 wrote to memory of 268	1924	32f92c618b7d5da544b9a21e9fb4529bb4c863d5b24e577bbf8b49dfe42a2eec.exe	28

C:\Users\Admin\AppData\Local\Temp\32f92c618b7d5da544b9a21e9fb4529bb4c863d5b24e577bbf8b49dfe42a2eec.exe
"C:\Users\Admin\AppData\Local\Temp\32f92c618b7d5da544b9a21e9fb4529bb4c863d5b24e577bbf8b49dfe42a2eec.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 412
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:268

memory/1924-54-0x0000000075551000-0x0000000075553000-memory.dmp

Filesize
8KB

Download
memory/1924-57-0x0000000074420000-0x00000000749CB000-memory.dmp

Filesize
5.7MB

Download
memory/1924-58-0x0000000074420000-0x00000000749CB000-memory.dmp

Filesize
5.7MB

Download