f87e3e2ba0f1e78437190fd300029e522e5c0c6405bfdb941ca597b58b105d44

Analysis

max time kernel
175s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 01:44

Target

f87e3e2ba0f1e78437190fd300029e522e5c0c6405bfdb941ca597b58b105d44.exe
Size

44KB
MD5

3e41aa060d88846a2e970e19256d6cd0
SHA1

cd684331561a4fa14632f34479902156e8fc9e01
SHA256

f87e3e2ba0f1e78437190fd300029e522e5c0c6405bfdb941ca597b58b105d44
SHA512

cb67a43c975b7a95d39ae392838ef6ad0633c8fc622df19b4d49efb977414e72317bfe5a11a9d3e8f3b04d374b7bb8574e4c93e7d7052d4fe32f195947c5ed3b
SSDEEP

768:+UHDVSqSLfSbaxmnZ2S1581N6HUjHPSqvtK1o7Mr1LT8N5a/gEnjd7kTSkfs0:MmA5o81W1H8NEnjFkT

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
900	dw20.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 972 wrote to memory of 900	972	f87e3e2ba0f1e78437190fd300029e522e5c0c6405bfdb941ca597b58b105d44.exe	28
PID 972 wrote to memory of 900	972	f87e3e2ba0f1e78437190fd300029e522e5c0c6405bfdb941ca597b58b105d44.exe	28
PID 972 wrote to memory of 900	972	f87e3e2ba0f1e78437190fd300029e522e5c0c6405bfdb941ca597b58b105d44.exe	28
PID 972 wrote to memory of 900	972	f87e3e2ba0f1e78437190fd300029e522e5c0c6405bfdb941ca597b58b105d44.exe	28

C:\Users\Admin\AppData\Local\Temp\f87e3e2ba0f1e78437190fd300029e522e5c0c6405bfdb941ca597b58b105d44.exe
"C:\Users\Admin\AppData\Local\Temp\f87e3e2ba0f1e78437190fd300029e522e5c0c6405bfdb941ca597b58b105d44.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:972
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 424
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:900

memory/972-54-0x0000000074D81000-0x0000000074D83000-memory.dmp

Filesize
8KB

Download
memory/972-55-0x00000000742A0000-0x000000007484B000-memory.dmp

Filesize
5.7MB

Download
memory/972-58-0x00000000742A0000-0x000000007484B000-memory.dmp

Filesize
5.7MB

Download